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data  bus  and  an  integrated  hierarchical  data  bus.  The  hierarchical  data  bus 
was  selected  for  the  FTEPS.  In  Task  3,  conceptual  designs  were  developed  for  a 
3  generator  configuration  and  a  4  generator  configuration  with  the  4  generator 
configuration  being  selected  for  further  development  in  Task  4,  Preliminary 
Design.  Preliminary  designs  were  developed  for  the  power  generator  system,  the 
distribution  system,  the  data  bus  control  system,  the  integrated  load  simulator, 
and  a  laboratory  support  system. 


SUMMARY 


This  interim  technical  rpport  presents  the  results  of  Phase  II,  Analysis  and 
Preliminary  Design,  of  the  Fault  Tolerant  Electrical  Power  System  program. 

In  Task  1  of  Phase  II  the  basic  requirements  for  the  FTEPS  demonstrator  were 
developed.  The  reliability  requirements  for  power  supplied  to  flight 
critical,  mission  critical,  and  non-flight  critical  loads  were  established. 
Power  interruption  times  were  established  for  flight  critical  loads.  Tnese, 
combined  with  the  fault  conditions  specified,  form  the  basic  power  system 
design  requirements. 

A  load  profile  has  been  formulated  showing  the  power  requirements  during  the 
seven  flight  phases  identified.  The  total  connected  load  is  1 7 6k V A .  The 
maximum  power  required  during  any  flight  phase  is  102kVA,  during  the  combat 
phase. 

Analyses  were  conducted  which  showed  the  feasibility  of  using  a  control  system 
consisting  of  a  MI L- STD- 1 553 B  data  bus,  MI L-STD- 1 750A  data  processors,  and 
software  written  in  Ada  higher  order  language. 

In  Task  2  an  analysis  was  performed  to  determine  the  reliability  of  power 
delivered  to  the  main  bus  for  different  power  architectures.  The 
architectures  were  four-generator  configurations  and  three  generator 
configurations.  In  addition  similar  analysis  was  performed  on  the  ELMC  power 
architecture.  These  analyses  have  determined  the  reliability  of  the 
fundamental  building  blocks  of  the  FTEPS.  The  design  options  have  been 
identified  and  the  reliability  of  each  is  now  known. 

An  analysis  was  performed  on  two  data  bus  architectures,  the  integrated  single 
bus  and  the  integrated  hierarchical.  The  hierarchical  has  been  selected  for 
the  FTEPS.  The  bus  loading,  processor,  and  memory  requirements  have  been 
calculated  and  are  within  the  capabilities  of  the  MIL-STD-1553B  data  bus, 

MIL- STD- 1  7 50A  processors  and  the  hierarchical  architecture. 


The  primary  impact  of  the  ATF  aircraft  and  its  mission  on  the  FTEPS  is  the 
requirement  for  large  amounts  of  uninterruptible  power  for  flight  and  mission 
critical  power.  In  addition,  a  large  quantity  of  power  is  considered  flight 
critical.  This  includes  electromechanical  actuators  and  environmental  control 
system  pumps.  Due  to  the  dense  electronic  packaging,  cooling  for  the  ATF  is 
also  flight  critical.  The  high  sortie  generation  requirements  dictate  a 
highly  reliable  system  with  redundancy.  These  requirements  have  been  factored 
into  the  requirements  analyses  and  trade  studies. 

In  Task  3,  conceptual  designs  were  developed  for  two  configurations,  a  three 
qenerator  and  a  four  generator  configuration.  Both  configurations  met  the 
reliability  requirements  of  the  loads;  however,  only  the  four  generator 
configuration  meets  the  fault  requirements  of  the  program.  A  control  system 
was  developed  based  on  the  hierarchical  data  bus  architecture.  In  this 
architecture  the  power  system  processor  performs  the  bus  control  function  for 
the  electrical  bus  and  functions  as  a  remote  terminal  on  the  vehicle 
management  system  (VMS)  data  bus.  Based  on  the  results  of  the  Conceptual 
Design,  the  four  generator  configuration  with  the  hierarchical  data  bus 
architecture  was  recommended  for  development  in  the  Preliminary  Design  Task. 

In  Task  4,  a  preliminary  design  was  developed  for  a  four  generator  system. 

Tne  design  included  the  power  generation  system,  the  distribution  system,  the 
data  bus  control  system,  a  load  simulator,  and  laboratory  support  system.  The 
preliminary  design  included  a  functional  description  of  all  components  and  a 
definition  of  all  interfaces.  The  preliminary  design  effort  al sr  covered  the 
system  software.  The  software  effort  consisted  of  performing  a  Structured 
Analysis  on  the  software  for  the  following  components;  power  system 
processors,  electrical  load  management  centers,  remote  terminals  and  avionics 
s  irnu  1  ator . 
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PREFACE 


This  Interim  Technical  Report  presents  the  results  of  work  performed  by  the 
Boeing  Military  Airplane  Company,  Seattle,  Washington  under  Air  Force  Contract 
F3361 5-85-C-2504 .  The  work  is  sponsored  by  the  Aero  Propulsions  Laboratory, 
Air  Force  Wright  Aeronautical  Laboratories,  Wright-Patterson  Air  Force  Base, 
Ohio.  Mr.  Joseph  A.  Weimer,  AFWAL/P00C-1  is  the  project  engineer. 

This  report,  which  covers  Phase  II,  Analysis  and  Preliminary  Design  of  the 
FTEPS  Demonstrator,  fulfills  the  requirements  of  CDRL  item  number  8.  The  work 
reported  herein  was  performed  during  the  period  1  July  1985  to  31  March  1986. 

The  program  manager  is  I.  S.  Mehdi .  This  report  was  prepared  by  Mark  W.  Dige, 
Patrick  J.  Leong,  and  David  L.  Sommer.  Significant  contributions  were  made  by 
Frederick  D.  N.  Gould,  Cathy  P.  Ho,  Jeffrey  S.  Kuest,  and  Todd  E.  Newell. 
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INTRODUCTION 


1  .0 

The  two  objectives  of  this  program  are  to  produce  a  low-cost  FTEPS  design  for 
an  ATF  aircraft  and  to  design  and  fabricate  a  low-cost  FTEPS  demonstrator  with 
an  integrated  load  simulator  for  an  ATF.  The  purpose  of  the  program  is  to 
develop  an  electrical  power  generation  and  distribution  system  that  can  supply 
electrical  power  to  the  various  critical  systems  on  the  aircraft  with  a 
reliability  and  power  quality  level  commensurate  with  the  requirements  of  the 
loads.  Faults  in  the  electrical  system  can  and  do  occur  due  to  various 
reasons.  Adequate  protection  and  controls  to  prevent  propagation  of  these 
faults  within  the  system  need  to  be  incorporated  such  that  other  normally 
operatinq  electrical  power  channels  are  not  effected. 

Future  aircraft  are  incorporating  advancements  in  digital  computer  technology 
for  more  and  more  of  the  stability  and  control  of  the  aircraft  as  well  as 
mission  functions.  Some  of  the  functions  on  the  aircraft  can  be  categorized 
as  mission  critical  and  loss  of  these  functions  could  therefore  keep  the 
aircraft  from  completion  its  mission.  More  importantly,  there  are  functions 
on  the  aircraft  which  are  flight  critical  and  loss  of  these  functions  would 
not  only  cause  termination  of  the  mission  but  also  loss  of  the  aircraft 
itself,  especially  when  the  aircraft  is  a  fly-by-wire  (FBW)  aircraft. 

Tii e  FTEPS  program  is  a  five-phase,  42  month,  program  as  shown  below; 

Phase  I  -  Load  Study 

Phase  II  -  Analysis  and  Preliminary  Design 

Task  1  -  FTEPS  Demonstrator  Basic  Requirements 
Task  2  -  FTEPS  Analysis,  Trade-off  Study,  and  Specific 
Requirements 

Task  3  -  FTEPS  Demonstrator  Conceptual  Design 
Task  4  -  FTEPS  Demonstrator  Preliminary  Desiqn 

Phase  III  -  Detailed  Design 

Phase  IV  -  Fabrication 


Phase  V 


Testing  and  Reporting 


This  report  documents  the  work  done  in  Phase  II,  Analysis  and  Preliminary 
Design.  Phase  II  consisted  of  the  four  tasks  mentioned  above.  Task  1  and  ? 
were  run  concurrently  and  covered  a  3  month  period.  The  results  of  Task  1  and 
2  are  documented  in  section  2,  Electrical  System  Requirements  and  Analyses. 
Task  3  covered  a  3  month  period  and  the  results  are  documented  in  section  3, 
Conceptual  Design.  Task  4  also  covered  a  3  month  period  and  the  results  are 
documented  in  section  4,  Preliminary  Design. 
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2.0  ELECTRICAL  SYSTEM  REQUIREMENTS  AND  ANALYSIS 

In  Task  1  and  2  of  Phase  II,  trade  studies  and  analyses  were  conducted  to 
determine  the  level  of  integration  and  redundancy  of  the  electrical  power 
system  components  and  devices  to  meet  the  basic  requirements  of  the  electrical 
power  reliability  for  flight  critical,  mission  critical  and  non-flight 
critical  loads.  Based  on  the  results  of  the  trade  studies  and  analyses, 
specific  requirements  for  the  FTEPS  demonstrator  were  developed. 

2.1  Electrical  Loads 

A  load  profile  for  the  ATF  mission  was  developed  based  on  the  load  list 
developed  in  Phase  I  (Ref.  1).  Figure  2.1-1  shows  a  tabulation  of  the  loads 
for  all  the  flight  phases  and  also  the  maximum  connected  load.  A  load  profile 
for  the  FTEPS  is  shown  in  Figure  2.1-2.  The  maximum  connected  load  is  176,366 
VA.  The  minimum  connected  load  which  occurs  during  emergency  operation  is 
9,134  VA.  The  largest  steady  state  load  occurs  during  the  combat  phase  and  is 
equal  to  102,082  VA. 

2.2  Reliability  Requirements 

FTEPS  is  required  to  deliver  electric  power  to  the  loads  100  times  more 
reliable  than  the  loads  themselves.  The  reliabilities  of  the  individual  loads 
are  too  diverse  to  enable  the  FTEPS  to  be  tailored  to  the  requirements  of  each 
individual  load.  A  practical  approach  to  this  problem  was  to  calculate  a 
single  reliability  number  for  each  of  the  load  categories.  The  reliability 
specification  for  the  system,  in  which  the  load  is  a  part,  was  used  rather 
than  the  reliability  of  the  load  itself.  Certain  loads  are  far  more  reliable 
than  their  system  specification  requires,  which  could  impose  unnecessarily 
severe  requirements  on  FTEPS.  Not  all  elements  of  a  system  have  the  same 
reliability  requirements  such  that  the  reliability  of  the  system  is  driven  by 
the  component  of  least  reliability.  Supplying  the  low  reliability  components 
with  power  which  meets  the  reliability  requirements  of  the  high  reliability 
components  doesn't  significantly  enhance  the  system  reliability. 
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RADAR  SENSOR 
SYSTEM 

INEWS  SENSOR 
SYSTEM 

CNI SENSOR 
SYSTEM 

IRST  SENSOR 
SYSTEM 

INFORMATION 

MANAGEMENT 

SIGNAL 

PROCESSORS 

MISSION 

AVIONICS 

VEHICLE  MAN. 
SYSTEM  RACKS 

ENGINE 

CONTROLS 

SECONDARY 

POWER 

FUEL 

INERTING 

FUEL  SYSTEM 

FLIGHT  CONTROL 
ACTUATOR 

LIGHTING  & 

MISC. 

STORES 

MANAGEMENT 


MAX  CON 

TAXI 

CLIMB 

DASH 

COMBAT 

LANDING 

CRUISE 

10,800 

2,168 

2,168 

10,800 

10,800 

2,168 

10,800 

13,600 

13,600 

13,600 

13,600 

13,600 

13,600 

13,600 

2,975 

2,975 

2,975 

2,975 

2,975 

2,975 

2,975 

3,000 

1,024 

1,024 

3,000 

3,000 

1,024 

3,000 

1,125 

1.125 

1,125 

1,125 

1,125 

1,125 

1,125 

5,200 

5,200 

5,200 

5,200 

5,200 

5,200 

5,200 

900 

900 

900 

900 

900 

900 

900 

2,200 

2,200 

2,200 

2,200 

2.200 

2,200 

2,200 

400 

400 

400 

400 

400 

400 

400 

750 

750 

750 

- 

- 

- 

- 

8,342 

8,342 

8.342 

8,342 

8,342 

8.342 

8,342 

20,849 

6.449 

16,049 

9,649 

9,649 

8,049 

7,249 

31,432 

860 

1,284 

826 

3,358 

860 

1,284 

1,731 

1,731 

1,731 

1,731 

1  ?}i 

1,731 

32,080 


TOTALS 


982 

982 

982 

982 

982 

982 

982 

40,000 

34,800 

38,800 

40,000 

38,800 

34.800 

38,000 

176.366 

83,506 

97,530 

101,730 

102,082 

84,356 

97,788 

Figure  2.1-1.  FTEPS  Electrical  Power  System  Loading 
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2.2.1  Flight  Critical  Loads 


The  reliability  for  flight  critical  loads  is  dictated  by  the  requirements  of 
the  flight  control  system  which  makes  up  the  largest  portion  of  the  flight 


critical  system.  MIL-F-9490D  assigns  a  probability  of  loss  of  fighter 
aircraft  due  to  a  flight  control  system  malfunction  of  100  x  10"^.  Flight 


control  system  failures  can  be  broken  up  to  be  25  percent  due  to  hydraulic 
power,  12.5  percent  due  to  mechanical  actuation  systems,  and  62.5  percent  due 
to  electrical  controls. 


The  electrical  controls  portion  of  the  flight  control  system  is  at  least  a  two 
channel  dual -redundant  system.  Therefore,  the  reliability  of  a  single  FTEPS 
flight  critical  load  is  no  more  than  the  reliability  of  one  channel  of  the 
electrical  control  portion  of  the  flight  control  system.  The  single  channel 
reliability  is  the  square  root  of  the  two  channel  dual-redundant  system 
rel i abi 1 ity . 


Probability  of  Failure  of  Flight  Control  System  =  Qp^ 


Probability  of  failure  of  Electrical  Control  Portion  of  the  Flight  Control 
System  =  Q£c 


Qec  =  (0*625)  (OpQ^) 


,-7v 


Qec  =  (0.625)  (100  x  10_/) 
QeC  =  6.25  x  10“6 


Probability  of  failure  of  a  single  channel  of  the  electrical  control  portion 


of  the  Flight  Control  System  =  Q 


sc 


(Qsc^Qsc^  ~  QEC 

(QscL  =  QEC  , 

(Q  )  =  6.25  x  10"° 
sc  - 

Q  =  2.5  x  10'  1 
sc 
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Failures  of  the  electrical  control  functions  are  due  to  failures  in  the 
electrical  control  portion  itself  and  failures  in  the  electrical  power  system 
supplying  power  to  the  electrical  control  portion.  The  electrical  power 
system  is  required  to  be  100  times  more  reliable  than  the  load  it  is  supplying 
which  is  a  single  channel  of  the  electrical  control  portion  of  the  flight 
control  system. 


Unreliability  of  the  electrical  power  system  =  Q, 

■>  ~-3 


k-3 


EPS 


Q  + 
sc 

QEPS  ’ 

2.5 

qeps  : 

=  ^sc  : 

100 

Q  + 
^sc 

(0.01) 

^sc 

qeps  ; 

=  2.48 

x  10' 

2.2.2 

Mission 

As  in  the  flight  critical  loads,  it  is  not  feasible  to  tailor  the  FTEPS  to 
meet  the  reliability  requirements  of  each  and  every  individual  mission 
critical  load.  The  USAF  Advanced  System  Avionics  program  (Contract  No. 

F3361 5-85-C-1816)  requires  the  survival  essential  mission  critical  equipment 
to  have  a  mean  time  between  failure  of  200  hours  or  an  unreliability  (Q^) 
of  l.OxlO-2.  This  requirement  is  conservative  as  not  all  mission  critical 
equipment  is  survival  essential.  Survival  essential  equipment  includes  such 
systems  as  the  Radar  Sensor  System.  When  in  a  terrain  following/terrain 
avoidance  mode,  a  failure  of  the  Radar  Sensor  System  may  place  the  airplane  in 
jeopardy  without  being  flight  critical. 


Qav  =  probability  of  failure  of  survival  essential  avionics 
Q^p  =  probability  of  failure  of  electrical  power 

The  requirement  for  electrical  power  supplied  to  mission  critical  loads  is 
that  the  reliability  of  the  electrical  power  be  100  times  greater  than  the 
reliability  of  the  load.  Failures  in  the  airplane  avionics  are  due  to 
failures  of  the  avionics  or  failures  in  the  electrical  power  system. 
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upsets  the  functioning  of  the  load.  Shown  in  Fiqure  ?.3-l  is  a  tabulation  of 
the  flight  critical  loads  and  their  power  interruption  time  limit.  Also  shown 
in  this  list  are  the  mission  avionics  system  (MAS)  computer  racks  which  are 
mission  critical.  These  were  included  because  they  are  as  sensitive  to  power 
interruptions  as  the  vehicle  management  system  (VMS)  computer  racks.  The 
program  requirement  is  to  keep  power  interruptions,  to  flight  critical  loads, 
less  than  50  percent  of  the  maximum  allowable  time  for  the  individual  load. 

The  system  design  objective  for  normal  power  to  the  loads  is  to  keep  power 
interruptions  to  a  50  millisecond  maximum,  which  is  within  the  requirements  of 
most  loads.  This  is  achieved  by  transferring  a  load  to  an  alternate  source 
when  a  power  dropout  is  detected.  If  the  maximum  allowable  power  interruption 
for  a  load  is  less  than  50  milliseconds,  the  transfer  method,  in  general, 
cannot  be  used.  For  these  cases  a  method  which  ensures  virtual 
uninterruptible  power  must  be  used.  This  will  be  accomplished  by  paralleling 
the  battery  with  another  source,  such  as  the  TRUs.  The  battery  will  provide 
"fill-in"  power  during  interruptions  on  the  main  aircraft  power  buses. 
Paralleling  eliminates  time  delays  associated  with  switching. 

2.4  Fault  Requirements 

The  FTEPS  fault  requirements  are  established  by  the  program  statement  of 
work.  The  FTEPS  must  be  able  to  sustain  multiple  faults  and  still  provide 
electrical  power  to  the  loads.  Three  faults  must  be  sustained  without  loss  of 
power  to  any  flight  critical  load,  two  faults  without  loss  of  power  to  any 
mission  critical  load,  and  one  fault  without  loss  to  any  nonflight  critical 
load.  The  faults  may  occur  at  different  elements  in  the  same  power  channel, 
the  same  elements  in  different  power  channels,  or  any  combination  thereof. 

2.5  Data  Bus  Analysis 

Data  bus  loading  studies  were  conducted  in  the  Advanced  Aircraft  Electrical 
System  Control  Technology  Demonstrator  (AAESCTD)  program,  AFWAL-TR-83-2033 . 
Three  architectures  were  analyzed,  single  integrated,  hierarchical,  and 
non-integrated.  In  the  AAESCTD  program,  load  complements  of  between  500  and 
350  loads  were  analyzed.  The  load  list  prepared  in  Phase  I  accounts  for  269 
loads.  For  the  bus  loading  study,  this  number  was  rounded  up  to  300. 


FLIGHT  CRITICAL 

POWER 

INTERRUPTION  TIME 

VMS  RACK  1 

50  MSEC 

VMS  RACK  2 

50  MSEC 

VMS  RACK  3 

50  MSEC 

VMS  RACK  4 

50  MSEC 

ELEC  ENG  CONT  UNIT  1 

50  MSEC 

ELEC  ENG  CONT  UNIT  2 

50  MSEC 

L  CANARD  IAP1 

2  SEC 

L  CANARD  IAP2 

2  SEC 

R  CANARD  IAP1 

2  SEC 

R  CANARD  IAP2 

2  SEC 

L  RUDDER IAP 

2  SEC 

R  RUDDER  IAP 

2  SEC 

L  FLAP IAP 

2  SEC 

R  FLAP IAP 

2  SEC 

14  DISACS 

500  mSEC 

COOLANT  PUMP  1A  +  IB 

2  SEC 

COOLANT  PUMP  2A  +  2B 

2  SEC 

MISSION  CRITICAL 

MAS  RACK  1 

50  MSEC 

MAS  RACK  2 

50  MSEC 

Figure  2.3- 1.  Power  Interruption  Times 


It  is  assumed  that  for  each  load  there  is  a  control  bit,  a  status  bit,  and  a 
trip  indication  bit.  With  processing  capability  in  the  electrical  load 
management  center  (ELMC),  the  trip  indication  bit  is  not  transmitted  on  the 
data  bus,  but  is  processed  within  the  ELMC.  This  reduces  the  data  bus  loading 
and  also  the  power  system  processor  loading. 

For  the  bus  loading  study,  each  architecture  consists  of  10  terminals,  plus 
the  power  system  processors.  There  are  five  ELMCs,  2  generator  control  units 
(GCUs),  and  three  remote  terminals  (RTs).  It  is  probable  that  the  number  of 
terminals  will  change;  however,  the  total  data  transmitted  on  the  bus  will 
likely  remain  the  same  for  a  given  SSPC  complement.  Thus,  the  bus  loading 
should  not  change  significantly. 

Data  bus  loading  is  defined  as  the  time  required  to  transmit  the  required 
data,  including  overhead,  divided  by  the  total  time  available.  The  overhead 
included  in  the  bus  loading  analysis  is  the  time  for  the  inter-message  gap, 
message  response,  mode  command  word  and  status  word.  The  bus  traffic  for  the 
different  architectures  are  shown  in  Table  2.5-1.  The  traffic  is  calculated 
based  on  the  ELMCs  having  processing  capability.  This  is  the  concept  to  be 
lised  on  the  FTEPS  demonstrator.  The  300  SSPC  complement  reflects  the  FTEPS 
load  count.  The  other  complements  are  from  the  AAESCTD  program. 
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TABLE  2.5-1 

NUMBER  OF  DATA  BITS  TRANSMITTED 


Terminal  Discrete  Inputs  Discrete  Outputs 

Type  SSPC  Complement  SSPC  Complement 


500 

450 

400 

350 

300(3) 

500 

450 

400 

350 

300(3) 

(1) 

(2) 

(1) 

(2) 

(1) 

(2) 

(1) 

(2) 

(1) 

(2) 

ELMC1 

150 

150 

135 

135 

120 

120 

105 

105 

90 

90 

118 

106 

94 

83 

70 

ELMC2 

150 

150 

135 

135 

120 

120 

105 

105 

90 

90 

118 

106 

94 

83 

70 

r  n 

167 

250 

150 

225 

134 

200 

117 

175 

100 

150 

118 

106 

94 

83 

70 

GCU1 

50 

50 

45 

45 

40 

40 

35 

35 

30 

30 

50 

45 

40 

35 

30 

ELMC3 

150 

150 

135 

135 

120 

120 

105 

105 

90 

90 

118 

106 

94 

83 

70 

ELMC4 

150 

150 

135 

135 

120 

120 

105 

105 

90 

90 

118 

106 

94 

83 

70 

ELMC5 

150 

150 

135 

135 

120 

120 

105 

105 

90 

90 

118 

106 

94 

83 

70 

RT2 

167 

250 

150 

225 

134 

200 

117 

175 

100 

150 

118 

106 

94 

83 

70 

GC'  2 

50 

50 

45 

45 

40 

40 

35 

35 

30 

30 

50 

45 

40 

35 

30 

RT3 

167 

250 

150 

225 

134 

200 

117 

175 

100 

150 

118 

106 

94 

83 

70 

(  I)  Integrated  and  hierarchical  architecture 
(2)  Non-integrated  architecture 
(  3 )  FTEPS  complement 
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TABLE  2.5-2 


DATA  BUS  LOADING 


Architecture  %  Loading  Per  SSPC  Complement 


Type 

500 

450 

400 

350 

300 

Integrated 

Smart  RT 

52 

51 

51 

51 

50 

Hierarchical 
Smart  RT 

25 

25 

25 

24 

24 

Non-integrated 
Smart  RT 

26 

25 

25 

25 

24 

Inputs  refer  to  data  from  the  RT  to  the  data  bus.  Outputs  refer  to  data 
coming  off  the  data  bus  to  the  RT.  For  the  non-integrated  architecture,  83 
discrete  inputs  are  added  to  RT1,  RT2,  and  RT3.  These  are  avionics  inputs 
which  the  electrical  system  processors  require  to  manage  the  electrical 
system.  These  discretes  are  not  included  in  the  integrated  or  the 
hierarchical  data  bus  architecture,  since  this  data  is  assumed  to  be 
transmitted  directly  to  the  electrical  system  processor  from  the  avionics 
processors.  All  data  words  transmitted  on  the  bus  are  assumed  to  be  packed  12 
data  bits  per  16  bit  word.  This  will  allow  expansion  of  four  bits  per  word. 
Data  bus  I/O  is  bimodal  to  meet  response  times  of  50  msec  and  300  msec.  Five 
percent  of  the  I/O  is  spread  over  two  minor  cycles  and  95%  of  the  I/O  is 
spread  over  16  minor  cycles. 

The  bus  loading  results  for  each  architecture  for  the  SSPC  complements  are 
shown  in  Table  2.5-2.  For  the  integrated  architecture,  it  is  assumed  that  the 
minor  cycle  synchronization  mode  code  to  each  of  the  power  system  devices  is 
part  of  the  avionics  bus  load.  The  bus  loading  figures  for  the  hierarchical 
and  non-integrated  architectures  includes  the  overhead  of  sending  the  minor 
cycle  mode  codes  to  the  power  devices. 

For  the  integrated  architecture,  the  bus  loading  includes  a  36%  avionics 
loading.  This  is  based  on  DAIS  data  which  was  identified  in  the  AAESCTD 
program.  From  the  data  shown  in  Table  2.5-2,  all  data  bus  loadings  are 
acceptable,  allowing  for  100%  growth;  however,  when  the  avionics  bus  traffic 
projected  for  PAVE  PILLAR  is  considered,  the  integrated  architecture  cannot  be 
implemented  using  che  MIL-STD-1553B  data  bus. 
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\  Three  data  buses 

constitute  the  core  of  the  information  transfer  network  for 

I  the  PAVE  PILLAR  c 

ivionics  system:  the  vehicle  management  system  (VMS)  bus,  the 

mission  avionics 

system  (MAS)  bus,  and  a  background  bus  for  mass  memory  block 

|  data  transfers. 

In  the  USAF/Boeing  Advanced  System  Integration  Demonstrations 

( ASID)  Sy  .tern  De' 

finition  program  (Ref.  2),  AFWAL-TR-84-I 193,  estimates  of  the 

data  bus  loading 

were  established.  A  summary  of  data  bus  loading  is  presented 

in  F i gure  ? . 5-1 . 

* 

All  three  buses  require  throughput  capacity  and  control 

1  characteristics  r 

iot  achievable  with  a  MIL-STD-1553B  avionics  multiplexing 

approach.  The  PL 

[L-STD-1553B  data  bus  has  a  bit  rate  of  1  M  bits/sec.  The 

vehicle  managemer 

it  system,  of  which  the  electrical  system  is  a  part,  has  a 

data  requirement 

bit  rate  of  0.73  M  bits/sec.  This  is  data  only  and  will 

j  exceed  the  1  m  bi 

t/sec  rate  of  MIL-STD-1553B  when  overhead  and  growth  is 

accounted  for.  1 

[he  PAVE  PILLAR  study  shows  that  a  high  speed  data  bus  is 

required.  Based 

on  the  PAVE  PILLAR  systems,  requirements  for  a  high  speed 

>  data  bus  have  be* 

1 

in  developed  and  are  shown  in  Table  2.5-3.  A  20  M  bit/sec 

data  throughput  r 

•ate  is  required. 

m 


ALL  FUNCTIONAL  I/O  ESTIMATES 


MASS 

MEMORY 

TRANSFERS 


MISSION 

AVIONICS 

SYSTEM 


VEHICLE 

MANAGEMENT 

SYSTEM 


8.1  Mbits/sec^ 


|5.96  Mbits/sec 


/  0.73  Mbits/sec 


♦  100%  DESIGN  MARGIN 


BACKGROUND 

BUS 


!  I 

16.2  Mbits/sec  i  \  j  1 

- >^---1  I 

12  Mbits/sec  j 


2.2  Mbits/sec 


Figure  2.5- 1.  PA  VE  PIL  LA  R  Data  Bus  Loading  Summary 


Table  2.5-3.  High  Speed  Data  Bus  Requirements 


l 


k  « 

W> 


II 

4 


ft 


Feature 


Requirement 


True  throughput 
Latency 
Trunk  length 
Control  scheme 
Protocol 
Access  schedule 

Priority 

Addressing  modes 
Number  of  stations 


20  MBPS 

5  ms  (max);  50  sec  variance  (goal) 

150m 

Distributed:  autonomous  access 

Single  standard  for  all  classes  of  service 

Must  support  periodic  transfers:  deterministic  timing 

statistics 

Support  dynamic  priority  assignment 
Physical,  multicast,  broadcast,  content  (label) 

Up  to  64  physical  taps:  256  (goal);  1024  (recommended) 


Message  size 
Error  detection 
Diagnostics 

Redundancy 

Medium 


1  word  to  4K  words 
32-bit  CRC 

Accessible  from  distributed  nodes,  self-testing 
interfaces,  integral  ref lectometry 
User-assigned  level 
Technology  independent 


For  the  FTEPS  demonstrator,  the  single  integrated  architecture  cannot  be  used, 
since  the  program  will  be  constrained  by  1  M  bit  rate  of  the  MIL-STD-1553B 
data  bus.  The  hierarchical  bus  architecture  is  the  most  suitable  since  the 
electrical  loading  can  he  handled  by  the  MIL-STD-1 553B  data  bus.  The  transfer 
of  data  between  the  avionics  data  bus  and  the  electrical  data  bus  can  be 
simulated  without  the  high  speed  data  bus. 
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2.6  FTEPS  Processor  and  Memory  Sizing 

To  determine  the  processor  memory  size,  the  following  hardware  was  assumed  to 
be  connected  to  the  MIL-STD-1553B  data  us: 

-  a  power  system  processor 

-  5  ELMC's  with  a  total  of  300  SSPC's 

-  3  power  system  RT's 

-  2  generator  control  units 
Processor  Loading 

Processor  loading  is  defined  as  the  amount  of  time  within  a  minor  cycle  that 
the  processor  is  busy  executing  application  and  executive  code.  The  loading 
of  the  power  system  processor,  smart  RT  with  1750A  microprocessor,  and 
executive  loading  are  discussed  below. 

Processor  Loading  -  Equations  Only 

The  processing  time  for  the  electrical  system  equations  was  derived  by  coding 
representative  equations  in  the  JOVIAL  J73/I  higher  order  language  and  then 
adding  the  execution  times  of  the  assembly  language  instructions  that  result 
when  they  are  compiled.  Although  the  analyses  are  based  on  the  use  of  the 
J73/I  programming  language,  the  results  are  applicable  to  the  Ada  programming 
language.  The  Ada  programming  language  has  the  capability  to  perform  the  same 
functions  and,  also,  to  perform  certain  functions  which  should  decrease  the 
executive  requirements.  The  electrical  system  equations  are  organized  into 
three  categories  as  defined  in  the  Advanced  Aircraft  Electrical  System  Control 
Technology  Demonstrator  program  (Ref.  3),  AFWAL-TR-83-2033 . 


Cateqory  I:  These  are  power  request  equations  and  are  of  the  form  Z=R  where 
R  may  take  one  of  the  following  forms: 

Form  1  One  variable  of  the  Form  A  or  A,  or  the  value  "logic  1" 

Form  2  Five  variables  arranged  in  any  valid  Boolean 
expression  with  each  variable  used  once  only 

Form  3  Twenty  variables  arranged  in  any  valid  Boolean 
expression  with  each  variable  used  once  only 

Form  4  Two  hundred  variables  arranged  as  the  sum  of  products 
with  each  product  term  composed  of  no  more  than  six 
variables  with  no  variable  repeated  in  the  Boolean 
expression 

Category  II:  C  =TP  (R  +  Q) 

Where  R  is  a  Boolean  expression  of  Form  1,  2,  3,  or  4  listed 
above;  Pisa  single  variable;  L  is  the  solution  to  the  latch 
equation  and  Q  is  test  request. 

Category  III:  I  =  (L  +  PX) 

Where  L  is  as  defined  in  Category  II  above;  P  and  X  are  single 
variables  available  to  the  system  designer  for  definition. 
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The  execution  time  per  equation  and  number  of  equations  are  shown  below. 


Equation  Category 

Processing 

T ime  Per 

Equation 

Number  of 

Equations 

Time  per 

Category 

Category  I 

Form  1 

16.5  usee 

125 

2063  usee 

Form  2 

49.25  usee 

142 

6994  usee 

Form  3 

134  usee 

27 

3618  usee 

Form  4 

1519  usee 

4 

6076  usee 

Category  II 

38  usee 

300 

1 1400  usee 

Category  III 

34  usee 

300 

10200  usee 

The  total  execution  time  for  all  equations  with  300  SSPC's  is  40351  usees. 

Processor  loading  was  calculated  for  systems  with  both  dumb  RT  and  smart  RT 
configurations.  In  the  dumb  RT  configuration,  the  power  system  processor 
calculates  all  equations.  In  the  smart  RT  configuration,  the  ELMC  and  RT's 
calculate  the  category  II  and  III  equations  and  the  processor  calculates  only 
the  category  I  equations. 

Equation  calculation  is  bimodal  to  meet  response  time  of  50  msec  and  300 
msec.  In  a  dumb  RT  configuration,  5%  of  the  calculations  are  spread  over  2 
minor  cycles  to  meet  the  50  msec  response  time  and  95%  of  the  calculations  are 
spread  over  32  minor  cycles  to  meet  the  300  msec  response  time.  In  a  smart  RT 
configuration,  5%  of  the  calculations  are  spread  over  2  minor  cycles  and  95% 
of  the  calculations  are  spread  over  16  minor  cycles. 

The  processor  loading  for  equations  only  is: 


No.  of  SSPC's 

300 

Dumb  RT's 

28% 

Smart  RT's 

20% 

Processor  Loading  -  Executive 

In  the  hierarchical  archi tecture,  the  power  system  processor  will  have  an 
executive  that  is  responsible  for  both  system  actions  and  local  actions.  In 
addition,  the  executive  will  have  processing  requirements  which  result  from 
being  a  remote  on  the  avionics  bus. 

For  the  hierarchical  architecture,  the  additional  processor  load  is  ?0%  of  the 
applications  processor  load,  the  executive  service  for  the  power  bus  is  15%, 
and  the  executive  service  for  the  avionics  bus  is  7%.  The  total  processor 
loading  with  300  SSPC's  is: 

Dumb  RT  55.6% 

Smart  RT  46% 

RT  Loading  -  Equations  Only 

In  the  smart  RT  configuration,  each  of  the  5  ELMC  RT's  will  have  a  1750A 
(Fairchild  9450)  microprocessor.  The  category  II  and  III  equations  are 
divided  equally  between  5  smart  RT's.  The  processing  of  equations  is  bimodal 
to  meet  response  times  of  50  and  300  msec.  The  processing  load  for  each  RT  is 
4.7%  with  5%  of  the  processing  spread  over  2  minor  cycles  and  95%  of  the 
processing  spread  over  16  minor  cycles. 

Memory  Requirements 

An  estimate  has  been  made  of  the  memory  requirements  for  the  power  system 
processor  and  for  a  smart  RT.  The  elements  competing  for  memory  are  as 
follows : 

-  executable  code  for  applications  equations 

-  other  executable  code  for  applications 

-  application  data 

-  executive  code 

-  executive  data 
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The  memory  requirements  for  the  equations  were  determined  by  coding 
representative  equations  in  the  J73/I  higher  order  language.  The  memory 
requirement  for  the  executive  is  estimated  at  12000  words.  The  results  are 
shown  below. 


Memory  Required  -  Words 


Equations 

Executive 

Total 

Processor  with  Dumb  RT 

2441  1 

12000 

3641  1 

Processor  with  Smart  RT 

10911 

12000 

22911 

RT  -  1750A 

2700 

- 

2700  (per  RT) 

2.7  Power  Bus  Architecture  Reliability  Analysis 

Six  power  system  designs,  which  included  three  generator  two  bus,  three 
generator  three  bus,  and  four  generator  four  bus  architectures,  were 
analyzed.  For  the  three  generator  two  bus  system,  two  configurations  were 
included,  isolated  sources  (Figure  2.7-1)  and  cross-strapped  sources 
(Figure  2.7-2).  For  the  three  generator  three  bus  system  only  one 
configuration  was  included,  isolated  sources  (Figure  2.7-3).  For  the  four 
generator  four  bus  system  (Figure  2.7-4),  fully  isolated  buses  (Figure  2.7-5), 
split  parallel  buses  (Figure  2.7-6)  and  cross-strapped  buses  (Figure  2.7-7) 
were  analyzed. 

The  MTBF  numbers  for  the  components  of  the  electrical  power  system  are  shown 
in  Table  2.7-1.  The  power  components  include  engines,  Super  Integrated  Power 
Unit  (SIPU),  Variable  Speed  Constant  Frequency  (VSCF)  generators,  VSCF 
converters,  gear  boxes  and  isolators  (clutches  and  contactors).  For 
isolators,  correct  control  commands  were  assumed  to  be  successfully 
transmitted  and  received.  The  mode  of  actual  switch  position  of  the  isolator 
is  either  good  or  bad.  The  rest  of  the  power  components  have  modes  of 
successful  operation  or  failure  (inoperable).  These  components  are  normally 
operational  with  the  exception  of  the  SIPU  which  is  normally  off. 
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DEFINE  FAULT  PATHS: 

•  Any  system  componenet  fails 
use  backup  when  available.  x-XvX' 

Otherwise  use  system  1 
as  power  source. 


SYSTEM  2  SYSTEM  1 

Figure  2.7- 1.  Secondary  Power  System  With  Three  Generators  Isolated  Sources 
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3)  Any  system  2  component  failure  & 
backup  component  failure: 

BASELINE  FAULT  PATHS:  -power  Bus  2  through  system  1 

1 )  Any  system  2  component  Failure:  4)  Engine  2  failure: 

-power  Bus  2  through  -provide  AMAD  2  power 

AMAO  2  and  SIPU  Generator  through  SIPU 

2)  AMAD  2  failure:  5)  Convertor  1  failed  and  some  component  in 

-power  Bus  2  through  SIPU  system  2  -|0  f|;|ed: 

and  SIPU  generator  —power  Bus  2  through  Angle  Gear  Box 

and  engine  1  wwwwvv 


SYSTEM  2  SYSTEM  1 

Figure  2.7-2.  Secondary  Power  System  With  Three  Generators, 
Cross-Strapped  Sources 
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Figure  2.7-3.  Secondary  Power  System  With  Three  Generators  (Brick  Wall  Configuration) 


The  results  of  the  analysis  are  shown  in  Table  2.1-2.  The  reliability  number 
is  the  probability  of  having  at  least  one  bus  powered.  A  two  hour  mission 
time  was  used. 

TABLE  2.7-1.  RELIABILITY  &  MTBF  OF  SECONDARY  POWER  SYSTEM  COMPONENTS 


Reliability  in 


Component 

MTBF  (Hours) 

a  two  hour  mission 

Contactor 

75,000 

0  .9999733337 

VSCF  Generator 

13,450 

0.9998513122 

VSCF  Converter/GCU 

9,410 

0.9997874827 

NFT 

546,450 

0.99999634 

AMAD  Gear  Box 

2,000 

0.9990004998 

ANGLE  Gear  Box 

2,000 

0.9990004998 

SIPU 

1,100 

0.9981834701 

ENGINE 

1,500 

0.9986675552 

CLUTCH 

200,000 

0.99999 

TABLE  2.7-2.  RELIABILITY  TABLE 


Secondary  Power 

Type  of 

System  Type 

Configuration 

Rel iabi 1  ity 

MTBCF  (Hours) 

3  Generator 

1 .  isolated  sources 

0.9999999748 

79,365,000 

2  Bus 

2.  cross-strapped  sources 

0.9999999338 

30,075,000 

3  Generator 

3.  fully  isolated 

0.9999999760 

83,333,000 

3  Bus 

4  Generator 

4.  fully  isolated  buses 

0.9999989880 

1,976,000 

4  Bus 

5 .  split  parallel  buses 

0.9999989931 

1 ,986,000 

6.  cross-strapped  buses 

0.9999989931 

1,986,000 

to  the  gear  box  and  SIPU  configuration, 
directly,  as  in  the  three  generator  con- 
path  goes  through  two  gearboxes  which  d 

The  difference  between  configuration  no: 
cross-strapping  between  the  gearboxes  u 
for  this  analysis,  a  failure  of  the  clu' 
angle  gear  box  will  disable  both  gearbo 
low  reliability  of  the  gearboxes,  mechai 
overall  system  reliability. 


3.0 


CONCEPTUAL  DESIGN 


Two  baseline  generating  and  distribution  concepts  were  selected  from  the  six 
concepts  studied  during  Task  2.  A  four  generator  architecture  is  required  to 
meet  the  fault  tolerance  requirements  of  large  flight  critical  loads  such  as 
the  environmental  control  system.  A  split-parallel  configuration  most  easily 
supplies  the  large  quantities  of  power  required  to  start  large  motor  loads 
such  as  the  environmental  control  system  without  power  quality  degradation. 
Therefore,  the  four-generator  four-bus  split-parallel  configuration  was  chosen 
for  development  during  conceptual  design.  The  three-generator  two-bus 
cross-strapped  configuration  was  chosen  for  development  during  conceptual 
design  as  a  bench  mark  to  compare  with  the  four-generator  four-bus 
arch i tecture. 

The  design  approach  taken  was  that  1)  distributed  buses  and  ELMCs  would  be 
used  to  minimize  the  hardware  burden  of  redundancy  and  provide  control  system 
interface  to  the  loads,  2)  the  ELMC  would  be  considered  as  part  of  the  load 
and  loss  of  an  ELMC  would  not  cause  less  of  any  flight  critical  load,  and  3) 
the  main  power  bus  would  be  considered  part  of  the  load  in  the  case  of  large 
loads  that  are  connected  directly  to  a  main  power  bus.  The  main  power  buses 
and  the  ELMC  power  buses  are  powered  from  two  sources.  Adding  an  additional 
feeder  to  a  load  from  a  main  power  bus  or  ELMC  bus  adds  two  sources  to  the 
load.  Several  loads  have  more  sources  than  their  fault  tolerance  requirement 
as  an  additional  feeder  gave  the  load  t*.'C  additional  sources  when  one  source 
would  have  fulfilled  the  load's  fault  tolerance  requirement. 

Control  system  architectures  were  developed  for  both  the  four-generator 
four-bus  configuration  and  the  three-generator  two-bus  configuration. 

Concepts  developed  for  the  ELMC  include  a  single  power  source  for  each  of  the 
AC  and  DC  buses,  dual  source  for  each  of  the  AC  and  DC  buses,  a  single  channel 
control  architecture  for  the  ELMC,  a  dual  channel  control  architecture,  and  a 
single  channel  control  architecture  with  dual  power  supplies.  A  conceptual 
design  for  the  FTEPS  integrated  load  simulator  was  developed  based  on  the 
loading  configuration  developed  during  Phase  I. 


3.1 


Four  Generator  Configuration 


A  four  generator  four  bus  configuration  was  developed  during  conceptual  design 
as  shown  in  Figure  3.1-1.  The  four  generators  are  normally  operated  in  a 
split-parallel  configuration  with  generators  on  opposite  AMADS  being 
paralleled.  Two  batteries  provide  backup  DC  power  for  loads  requiring 
uninterruptible  power.  Four  ELMCs  provide  multiplexed  load  control  with 
interface  to  the  FTEPS  power  system  processors. 

The  concept  developed  to  power  the  Vehicle  Management  System  (VMS)  racks  in 
the  four  generator  four  bus  architecture  is  shown  in  Figure  3.1-1.  Each  VMS 
rack  is  powered  from  three  sources.  Two  sources  are  115  Vac,  400  Hz,  from 
independent  ELMCs  and  the  third  source  is  28  Vdc  from  the  main  battery  bus. 

The  three  sources  are  tied  together  in  the  power  supply  which  is  internal  to 
the  VMS  rack.  Uninterruptible  power  is  provided  by  the  sealed  lead-acid 
battery  which  floats  on  the  battery  bus.  The  battery  potential  is  nominally 
24  V  so  that  power  is  supplied  to  the  battery  bus  by  the  transformer  rectifier 
unit  if  possible.  This  scheme  supplies  power  with  a  mean  time  between  failure 
( MTBF )  of  2 . 3x 1 01 1  hours  which  exceeds  the  flight  critical  requirement  of 

4 

8.1x10  hours.  The  two  ELMCs  chosen  to  supply  power  to  the  VMS  rack  are 
each  powered  from  two  independent  ac  sources  to  give  a  total  of  four  ac 
sources  to  each  VMS  rack.  The  battery  brings  the  total  ac  and  dc  sources  to 
each  VMS  rack  to  five  which  exceeds  the  FTEPS  requirement  of  four  sources. 

The  Mission  Avionics  System  (MAS)  racks  are  each  powered  by  an  ac  source  from 

an  ELMC  and  a  dc  source  from  an  independent  ELMC's  battery  bus  as  shown  in 

Figure  3.1-1.  This  distribution  concept  provides  electrical  power  to  each  MAS 
8 

rack  of  5.3x10  hours  MTBF.  Each  MAS  rack  is  provided  with  two  ac  sources, 
two  dc  sources,  and  one  battery  source  for  a  total  of  five  sources.  These 
reliability  and  redundancy  capabilities  exceed  the  FTEPS  mission  critical  load 

4 

requirement  of  2.0x10  hours  MTBF  and  the  FTEPS  mission  critical  fault 
tolerance  requirement  of  two  faults. 


The  power  distribution  concepts  developed  for  the  integrated  actuator  packages 
(IAP)  are  also  shown  in  Figure  3.1-1.  The  concept  is  to  power  each  IAP  with 
an  ac  source  from  two  of  the  four  main  ac  buses.  As  the  main  buses  are 
normally  operated  in  split  parallel,  each  IAP  feeder  is  powered  from  two 
generators.  This  gives  each  IAP  a  total  of  four  sources  and  a  MTBF  of 
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1.3x10  hours  which  exceeds  the  FTEPS  flight  critical  load  requirements. 

The  IAPs  can  withstand  a  1/2  second  power  interruption  and  therefore  do  not 
need  a  battery  source. 

The  digital  integrated  servo  actuator  controllers  (DISAC)  and  the  stick  and 

rudder  sensors  are  powered  from  the  battery  bus  of  two  separate  ELMCs  (Figure 

3.1-1).  These  loads  are  flight  critical  and  can  withstand  a  1/2  second  power 

interruption.  In  the  event  that  the  SIPU  should  fail  to  come  on  line  after 

loss  of  both  engines,  the  DISACs,  stick  sensors,  and  rudder  sensors  would  be 

needed  to  stabilize  the  airplane  to  allow  the  pilot  to  eject.  These  loads  are 

therefore  powered  from  the  ELMC  battery  bus.  The  four  generator  four  bus 

architecture  provides  the  same  two  independent  dc  sources  and  one  of  two 

independent  battery  sources  to  each  ELMC.  This  gives  a  total  of  four  sources 

to  each  DISAC,  stick  sensor,  and  rudder  sensor  which  meets  the  FTEPS  fault 

tolerance  requirement  for  flight  critical  loads.  The  MTBF  calculated  for  the 

g 

DISACs,  stick  sensors,  and  rudder  sensors  is  1.4x10  hours. 

The  ECS  system  is  powered  using  two  concepts,  (Figures  3.1-1).  Mission 
critical  ECS  equipment  such  as  the  main  compressors  are  powered  from  a  single 
main  ac  bus.  The  flight  critical  ECS  loads  are  powered  with  two  ac  sources 
from  the  main  ac  buses.  These  loads  require  too  large  a  quantity  of  power  to 
allow  them  to  be  powered  from  an  ELMC  using  a  solid  state  power  controller. 

All  the  ECS  loads  are  ac  and  too  large  to  consider  using  a  battery  and  an 
inverter  as  a  redundant  power  source.  The  four  generator  four  bus 
architecture  provides  two  sources  to  each  of  these  mission  critical  loads. 
These  loads  are  redundant  so  that  there  is  a  total  of  four  ac  sources  from  the 
main  bus  to  power  the  dual  redundant  set  of  loads.  This  concept  exceeds  the 
FTEPS  mission  critical  fault  tolerance  requirements  and  supplies  power  with  a 
MTBF  of  5.1x10^  hours,  which  exceeds  the  FTEPS  mission  critical  load 
reliability  requirement. 
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The  coolant  pumps  are  flight  critical  and  require  two  ac  sources  from  the  main 

ac  buses  to  meet  the  reliability  requirements.  The  four  generator  four  bus 

g 

architecture  supplies  power  with  a  MTBF  of  1.3x10  hours  and  provides  four 
ac  sources  to  the  coolant  pumps. 

The  concepts  developed  for  powering  the  FTEPS  fuel  pumps  are  shown  in  Figure 
3.1-1.  The  transfer  pumps  require  a  small  enough  quantity  of  power  to  allow 
them  to  be  powered  from  ELMCs.  The  boost  pumps  require  too  large  a  quantity 
of  power  to  allow  them  to  be  powered  from  an  ELMC  using  a  SSPC.  The  concept 
developed  for  the  boost  pumps  is  to  power  them  from  the  main  ac  buses.  The 
boost  pumps  are  each  sized  large  enough  to  supply  both  engines  in  the  event  of 
a  pump  failure.  The  four  generator  four  bus  architecture  supplies  each  boost 
pump  with  two  ac  sources  for  a  total  of  four  sources  to  the  dual  redundant 
set.  This  architecture  also  supplies  four  ac  sources  to  each  transfer  pump 
due  to  the  switching  action  of  the  ELMC.  The  FTEPS  mission  critical 
redundancy  requirements  are  satisfied  for  both  the  transfer  and  the  boost 
pumps  in  the  four  generator  four  bus  architecture.  The  four  generator  four 

4 

bus  architecture  supplies  power  with  a  MTBF  of  2.0x10  hours  to  the  transfer 

4 

pumps  and  5.1x10  hours  to  the  boost  pumps,  both  of  which  meet  the  FTEPS 
mission  critical  requirements. 

3.2  Three  Generator  Configuration 

The  three  generator  two  bus  architecture  and  distribution  concept  developed 
during  conceptual  design  is  shown  in  Figure  3.2-1.  Primary  AC  power  is 
supplied  by  two  AMAD  mounted  VSCF  generators  with  an  auxiliary  generator 
mounted  on  the  angle  gear  box.  Two  batteries  supply  backup  power  to  loads 
requiring  uninterruptible  power.  Four  ELMCs  provide  automated  load  management 
and  reconfiguration  as  well  as  interface  with  the  FTEPS  power  system 
processors  over  the  MIL-STD-1553B  data  bus. 

The  concept  developed  to  supply  power  to  the  VMS  racks  for  the  three  generator 
two  bus  architecture  is  shown  in  Figure  3.2-1.  Each  VMS  rack  is  powered  from 
two  ac  sources  provided  by  separate  ELMCs  and  one  source  from  one  of  the  two 
main  battery  buses.  This  configuration  provides  power  with  a  MTBF  of 
2.1x10  ^  ^  hours  which  exceeds  the  FTEPS  requirement  of  8.1x10^  hours  for 


Generator 


flight  critical  loads.  If  bus  faults  are  considered  above  the  ELMCs,  faults 
on  both  main  ac  buses  and  one  main  battery  bus  would  cause  loss  of  power  to 
two  VMS  racks.  If  like  faults  are  not  allowed,  this  architecture  supplies  the 
VMS  racks  with  four  sources,  three  ac  generators  and  one  battery. 

The  distribution  concept  developed  for  the  MAS  racks  is  also  shown  in  Figure 

3.2- 1.  Each  MAS  rack  is  powered  by  an  ac  source  and  a  battery  source  from 

independent  ELMCs.  One  of  the  two  sources  from  the  main  ac  buses  which  power 

the  ELMCs  ac  bus  also  supplies  power  to  the  ELMC's  battery  bus  under  normal 

conditions  so  that  the  battery  bus  source  feeding  each  MAS  rack  is  not  totally 

independent  of  the  ac  bus  feeding  each  MAS  rack.  The  reliability  of  power  to 

the  MAS  racks  could  not  be  precisely  calculated  due  to  the  dependencies  of  the 

three  generator  three  bus  architecture  but  can  be  approximated  to  be  the  same 

order  of  magnitude  as  the  power  supplied  to  the  MAS  in  the  four  generator  four 

bus  architecture.  This  reliability  greatly  exceeds  the  FTEPS  MTBF  requirement 
4 

of  2.0x10  hours  for  mission  critical  equipment.  This  concept  provides  two 
ac  sources  and  a  battery  source  for  a  total  of  three  independent  sources  to 
each  MAS  rack.  This  meets  the  FTEPS  mission  critical  fault  tolerance 
requirement. 

The  IAPs  in  the  three  generator  three  bus  architecture  are  powered  as  shown  in 

Figure  3.2-1.  As  this  architecture  has  two  ac  buses,  all  IAPs  are  powered 

from  the  same  two  buses.  The  three  generator  two  bus  architecture  provides 

each  IAP  with  three  ac  sources,  the  two  main  ac  generators  and  the  auxiliary 

generator  mounted  on  the  angle  gear  box,  which  does  not  meet  the  FTEPS  flight 

critical  fault  requirement.  The  IAPs  are  provided  power  with  an  MTBF  of 

g 

1 .4x10  hours  which  exceeds  the  FTEPS  flight  critical  load  requirement. 

The  digital  integrated  servo  actuator  controllers  (DISAC)  and  the  stick  and 
rudder  sensors  are  powered  from  the  battery  bus  of  two  separate  ELMCs  (Figure 

3.2- 1).  These  loads  are  flight  critical  and  can  withstand  a  1/2  second  power 
interruption.  In  the  event  that  the  SIPU  should  fail  to  come  on  line  after 
loss  of  both  engines,  the  DISACs,  stick  sensors,  and  rudder  sensors  would  be 
needed  to  stabilize  the  airplane  to  allow  the  pilot  to  eject.  These  loads  are 
therefore  powered  from  the  ELMC  battery  bus.  The  three  generator  two  bus 
architecture  provides  the  same  two  independent  dc  sources  and  one  of  two 


independent  battery  sources  to  each  ELMC  for  a  total  of  four  sources  to  each 

DISAC,  stick  sensor,  and  rudder  sensor.  This  meets  the  FTEPS  fault 

requirement  for  flight  critical  loads.  The  MTBF  calculated  for  the  DISACs, 

9 

stick  sensors,  and  rudder  sensors  is  1.4x10  hours. 

The  ECS  system  is  powered  using  two  concepts  (Figure  3.2-1).  Mission  critical 
ECS  equipment  such  as  the  main  compressors  are  powered  from  a  single  main  ac 
bus.  The  flight  critical  ECS  loads  are  powered  with  two  ac  sources  from  the 

main  ac  buses.  These  loads  require  too  large  a  quantity  power  to  allow  them 
to  be  powered  from  an  ELMC  using  a  solid  state  power  controller.  All  the  ECS 
loads  are  ac  and  too  large  to  consider  using  a  battery  and  an  inverter  as  a 
redundant  power  source.  The  three  generator  two  bus  architecture  supplies  two 
sources  to  each  of  the  dual  redundant  mission  critical  ECS  loads  for  a  total 
of  three  ac  sources  for  the  dual  redundant  set  as  the  auxiliary  generator  is 
not  counted  twice.  This  exceeds  the  FTEPS  mission  critical  fault  tolerance 
requirement.  The  three  generator  two  bus  architecture  supplies  power  with  a 

4 

MTBF  of  5.4x10  hours  which  exceeds  the  FTEPS  mission  critical  load 
reliability  requirement. 

The  coolant  pumps  are  flight  critical  and  require  two  ac  sources  from  the  main 

ac  buses  to  meet  the  reliability  requirements.  The  three  generator  two  bus 

g 

architecture  supplies  power  with  a  MTBF  of  1.4x10  hours  and  provides  three 
ac  sources  to  the  coolant  pumps  which  does  not  meet  the  FTEPS  flight  critical 
fault  tolerance  requirement. 

The  concept  developed  for  powering  the  FTEPS  fuel  pumps  for  the  three 
generator  architectures  is  shown  in  Figure  3.2-1.  The  transfer  pumps  require 
a  small  enough  quantity  of  power  to  allow  them  to  be  powered  from  ELMCs.  The 
boost  pumps  require  too  large  a  quantity  of  power  to  allow  them  to  be  powered 
from  an  ELMC  using  a  SSPC.  The  concept  developed  for  the  boost  pumps  (Figure 
3.2-1)  is  to  power  them  from  the  main  ac  buses.  The  boost  pumps  are  each 
sized  large  enough  to  supply  both  engines  in  the  event  of  a  pump  failure.  The 
three  generator  two  bus  architecture  provides  three  ac  sources  to  each  of  the 
transfer  pumps  due  to  the  ELMC's  bus  switching  action  and  three  ac  sources  to 
the  dual  redundant  set  of  boost  pumps.  Each  main  ac  bus  is  backed  up  by  the 
auxiliary  generator  in  the  three  generator  two  bus  architecture.  This 
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generator  is  only  counted  for  one  main  ac  bus  to  give  a  total  of  three  sources 

to  the  set  of  boost  pumps.  This  concept  meets  the  FTEPS  mission  critical 

fault  tolerance  requirement.  The  three  generator  two  bus  architecture 

4 

provides  power  with  a  MTBF  of  2.0x10  hours  to  the  transfer  pumps  and 
4 

5.4x10  hours  to  the  boost  pumps.  The  concepts  for  both  of  these  types  of 
loads  meet  the  FTEPS  mission  critical  load  reliability  requirements. 

3.3  Control  System  Architecture  Conceptual  Design 

Biock  diagrams  of  control  systems  for  the  three  generator  and  four  generator 
power  systems  were  developed  and  are  shown  in  Figures  3.3-1  and  3.3-2.  Both 
control  systems  represent  a  hierarchical  architecture  as  shown  in  Figure 
3.3-3.  The  area  shown  in  the  dotted  line  is  simulated  by  the  avionics 
simulator  and  the  control  console.  The  two  control  systems  differ  in  the 
number  of  generator  control  units,  remote  terminals  ( RTs )  and  the  auxiliary 
power  control  unit.  Hardwired  controls  are  provided  for  a  limited  number  of 
essential  functions,  such  as  for  emergency  override  and  startup  commands.  The 
type  of  data  bus  link  between  the  avionics  simulator  and  the  power  system 
processors  has  not  yet  been  defined.  The  RTs  provide  the  control  interface  to 
the  power  switching  devices  of  the  main  AC  and  DC  power  buses.  Dual  redundant 
power  system  processors  are  used  in  both  configurations.  A  discrete  hardwired 
data  link  is  used,  between  the  power  system  processors,  to  transfer  system 
control  from  one  processor  to  the  other  and  for  passing  data  to  update  the 
backup  processor.  Functional  descriptions  of  the  major  components,  power 
system  processor,  generator  control  unit,  ELMC,  remote  terminal,  and  avionics 
simulator,  are  shown  in  Figures  3.3-4  through  3.3-8.  A  cual  redundant 
MIL-STD-1553B  data  bus  is  used  to  transmit  the  bulk  of  the  data  in  the 
system.  Discrete  wiring  is  used  as  a  back-up  control  path  (to  the  data  bus) 
for  flight  critical  loads.  Due  to  the  system  fault  tolerance  requirements  (3 
faults  for  flight  critical  loads)  the  data  bus,  in  a  dual  redundant 
configuration  does  not  meet  this  requirement. 
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3.4  ELMC  Conceptual  Design 

Several  ELMC  configurations  were  analyzed  and  considered  for  use  in  FTEPS. 
The  baseline  configuration  shown  in  Figure  3.4-1  consists  of  three 
distribution  buses;  an  ac,  a  dc,  and  a  battery  bus.  The  ac  and  dc  buses  can 
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Figure  3.3- 1.  Three  Generator  Control  System 


Power  System  Processor 


•  System  startup/shutdown 

•  Load  priorities 

•  Power  request  equations 

•  Generator  status 

•  AC  bus  status 

•  DC  bus  status 

•  ELMC  status 


•  SSPC  status 

•  Configuration  control 

•  System  BIT 

•  Display  processing 

•  Avionics  system  interface 

•  Fault  diagnosis 

•  1553B  bus  control 
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Figure  3.3-4.  Power  System  Processor  Functions 
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•  Generator  regulation  and  control 

•  Generator  and  feeder  protection 

•  GCB  and  BTB  control 

•  Generator  BIT 

•  1553B  RT 
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Figure  3.3-5.  Generator  Control  Unit  Functions 


ELMC 

•  Startup/shutdown 

•  Power  bus  status 

•  Internal  power  bus 

•  SSPC  status 

•  Load  priority 

•  Diode  monitoring 

•  SSPC  control 

•  ELMC  BIT 

•  SSPC  reset 

•  1153BRT 
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Figure  3.3-6.  ELMC  Functions 


J.IH  f  m  t  WWW  HF  *  'J1  ny  rw  rw  ry  fjjj'  r\F  or  rTnrff-TnyrrwTrw  nimy  nynYnnnii»-  yi-.  *  - 


Remote  Terminal 

•  RCCB  control 

•  RCCB  reset 

•  RCCB  status 

•  Diode  Monitor 

•  Contact  Position  Monitor 

•  External  power  monitor 

•  1553B  RT 
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Figure  3.3  7.  Remote  Terminal  Functions 


Avionics  Simulator 

•  Initiate  load  request 

•  Control  mission  phase 

•  Control  display  data 

•  Control  load  simulator 
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Figure  3.3-8.  Avionics  Simulator  Functions 
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he  supplied  from  either  of  two  ac  buses  or  two  dc  buses  through  relays.  The 
battery  bus  is  primarily  supplied  by  the  dc  bus  with  battery  backup  available 
during  power  interruptions  to  the  dc  bus.  A  second  configuration  is  shown  in 
Fiqure  3.4-2.  This  configuration  is  basically  the  same  as  the  baseline  except 
that  the  relay  used  to  switch  the  power  sources  onto  the  distribution  buses 
has  been  deleted.  A  reliability  and  sensitivity  analysis  was  performed  on  the 
two  configurations  and  is  summarized  in  Figure  3.4-3.  This  analysis  shows 
that  little  gain  in  reliability  is  realized  by  adding  the  redundant  power 
source  and  relay  of  Figure  3.4-1;  however,  the  relay  adds  fault  tolerance  to 
the  electrical  system  by  enabling  the  ELMC  to  choose  among  two  power  sources 
for  the  distribution  bus. 

The  sensitivity  analysis  shows  that  the  electrical  remote  terminal  (ERT)  is 
largest  contributor  to  the  ELMC 1 s  unreliability.  The  most  gain  in  reliability 
can  be  achieved  by  increasing  the  reliability  of  the  ERT.  Three  ERT 
configurations  were  considered  for  use  in  the  ELMC.  The  baseline  ERT  is  shown 
in  Figure  3.4-4.  This  ERT  is  a  single  channel  system  consisting  of  a  power 
supply,  central  processing  unit,  memory,  bus  interface  unit,  analog 
input/output,  and  parallel  input/output.  The  dual  channel  ERT  shown  in  Figure 
3.4-5  contains  two  identical  channels  shown  in  Figure  3.4-4  with  a  bus  tie 
between  the  address  and  data  buses  of  the  two  channels.  The  third  ERT 
configuration  is  a  single  channel  system  with  dual  power  supplies  as  shown  in 
Figure  3.4-6.  A  reliability  analysis  was  performed  on  the  three  ERT 
configurations  and  results  are  shown  in  Figure  3.4-7. 

The  ELMC  must  deliver  high  quality,  reliable  power  to  the  flight  and  mission 
critical  FTEPS  loads.  The  reliability  and  power  interruption  requirements  of 
these  loads  require  that  they  have  more  than  one  power  source.  These  loads 
can  either  be  sourced  from  one  ELMC  or  several  ELMCs.  A  single  failure  in  the 
ERT  may  cause  the  ELMC  to  fail  to  supply  power  to  all  its  loads.  As  the  ERT 
has  the  lowest  reliability  of  any  of  the  ELMC's  components,  sourcing  flight 
and  mission  critical  loads  from  a  single  ELMC  will  not  meet  FTEPS  reliability 
and  redundancy  requi rements . 
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Figure  3.4-2.  Alternate  ELMC  Configuration 


CONFIGURATION  RELIABILITY 


ELMC  CONFIGURATION 

RELIABILITY  OF  POWER 

TO  AC  LOAD 

MTBF  OF  POWER 

TO  AC  LOAD  (HOURS) 

BASELINE 
(Figure  3.4-1.) 

0.999899542 

19,908 

ALTERNATE 
(Figure  3.4-2.) 

0.999899444 

19,888 

COMPONENT 

SENSITIVITY 

RELIABILITY  OF  POWER  TO 
LOAD  FROM  EITHER  AC  OR 
FLIGHT  CRITICAL  DC 

FAILURE  RATE  OF  POWER 
TO  LOAD  FROM  EITHER  AC 
OR  FLIGHT  CRITICAL  DC 
(FAILURES/HOUR) 

BASELINE 

0.999899543 

5.0231x10'® 

INCREASE  AC  BUS 
RELIABILITY  TO  0.999999 

0.999925207 

3.7398x10’® 

INCREASE  SSPC  TO 
0.999999 

0.999935820 

3.2091x10'® 

INCREASE  ERT  TO 
0.9999999 

0.999935920 

3.2041x10® 

INCREASE  BUS 
CONTRACTORS  TO 

0.999999 

0.999925207 

3.7398x10'® 

Figure  3. 4-3.  ELMC  Reliability  and  Sensitivity  Analysis 
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ADDRESS  AND  DATA  BUS 


Figure  3.4-4.  Single  Channel  ERT 
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Figure  3.4-5.  Dual  Channel  ERT 
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Figure  3.4-6.  Single  Channel  ERT  With  Dual  Power  Supplies 
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Figure  3.4-7.  ERT  Reliability  Analysis 
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PRELIMINARY  DESIGN 


An  FTEPS  preliminary  design  was  developed  based  on  the  the  four  generator- 
concept  developed  during  Task  3,  Conceptual  Design.  The  conceptual  design 
effort  focussed  on  two  cc nf igurations,  a  three  generator  and  a  four  generator 
configuration.  Both  configurations  met  the  reliability  requirements  of  the 
loads;  however,  only  the  four  generator  configuration  meets  the  fault 
requirements  of  the  program.  The  preliminary  design  of  the  control  system  is 
based  on  the  hierarchical  data  bus  architecture  developed  during  Conceptual 
Design.  Several  candidate  ELMC  configurations  were  evaluated  during  the 
Conceptual  Design.  The  configuration  selected  for  preliminary  design  is  shown 
in  Figure  3.4-1,  which  incorporates  a  single  channel  ERT. 

4.1  System  Description 

The  selected  FTEPS  configuration  is  a  four  generator  system  which  incorporates 
a  MIL-STD- 1553B  data  bus  and  MIL-STD-1 750A  computer  for  system  control  and 
solid  state  power  controllers  and  electromechanical  power  controllers  for 
fault  protection  and  load  control.  The  system  incorporates  electrical  load 
aanagement  centers  (ELMC)  which  are  distributed  load  buses.  The  ELMC  concept 
minimizes  the  hardware  burden  of  redundancy  and  provides  a  control  system 
interface  to  the  loads.  The  ELMCs  are  located  close  to  the  loads  and  in  a 
fault  analysis  is  considered  part  of  the  load.  Thus,  redundant  power  feeders 
(from  the  main  power  bus)  to  the  ELMC  are  considered  redundant  to  the  load 
even  if  there  is  a  single  power  feeder  between  the  load  and  ELMC.  For  large 
loads,  which  are  powered  directly  from  the  main  power  buses,  the  main  power 
bus  is  considered  part  of  the  load. 

The  data  bus  and  power  system  processors  are  not  considered  flight  critical. 
Loss  of  these  components  will  not  result  in  loss  of  power  to  any  flight 
critical  loads.  Adequate  hardwired  backup  control  and  localized  processing  in 
the  ELMCs  and  RTs  will  accomplish  this.  The  data  bus  and  processors  are 
mission  critical.  They  are  required  to  turn  certain  loads  on  and  off  during 
various  mission  phases  and  to  implement  load  shedding.  As  mission  critical 
equipment,  the  data  bus  and  processors  are  required  to  be  triple  redundant. 
Currently  MI L-STD- 1 553B  data  buses  are  configured  to  run  in  pairs,  thus  two 
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4.1.1  Power  System 


The  power  system  consists  of  four  60  KVA  variable  speed  constant  frequency 
(VSCF)  generators  which  are  operated  in  a  split  parallel  configuration.  The 
power  system  is  shown  in  Figure  4. 1.1-1.  Generators  1  and  2  are  paralleled 
and  generators  3  and  4  are  paralleled.  External  power  can  be  applied  to  AC 
buses  1  and  2  and  AC  buses  3  and  4  independently.  Two  generators  are  powered 
off  each  engine  as  shown  in  Figure  4. 1.1-2.  Emergency  and  auxiliary  power  is 
provided  by  the  SIPU  which  drives  the  main  generators  through  the  series  of 
clutches  and  the  angle  gearbox.  There  are  four  75  ampere  transformer 
rectifier  units  (TRU),  one  on  each  AC  bus.  The  original  power  system 
configurations  developed  during  Conceptual  Design  contained  two  TRUs.  This 
was  based  on  the  assumption  that  no  flight  critical  or  mission  critical  loads 
were  powered  off  the  DC  bus  without  battery  backup;  however,  the  stores 
management  system  requires  enough  DC  power  to  make  it  unfeasible  to  use 
battery  backup.  Each  of  the  eight  store  stations  requires  two  ten  amp  28  VDC 
inputs.  Since  the  stores  management  system  is  mission  critical,  the  power 
network  to  it  must  sustain  two  faults  and  still  remain  operational.  To  meet 
this  requirement  two  additional  TRUs  were  added.  Two  batteries  are  used  in 
the  system  for  emergency  power  and  for  power  to  loads  requiring 
uninterruptible  power.  Each  battery,  as  shown  in  Figure  4. 1.1-1,  is 
paralleled  with  two  TRUs.  The  batteries  are  lead  acid  and  are  float  charged. 
Power  is  distributed  to  the  loads  through  the  ELMCs  which  contain  the  SSPCs. 
The  four  ELMCs  in  the  system  are  connected  to  the  AC,  DC  and  battery  buses  as 
shown  in  Figure  4. 1.1-1.  Each  AC  and  DC  bus  in  the  ELMC  has  two  sources  of 
power  available  to  it.  Each  source  is  electrically  isolated  from  the  other 
and  also  mechanically  isolated.  The  ELMC  internal  battery  bus  is  paralleled 
with  the  main  battery  bus  and  the  internal  DC  bus.  The  SSPCs  are  connected  to 
the  internal  power  buses  in  the  ELMCs.  The  majority  of  loads  under  10  amps 
will  be  powered  by  the  SSPCs.  Loads  requiring  10  amp  or  more  will  be  powered 
off  the  main  AC  and  DC  buses.  For  these  loads  electromechanical  power 
controllers  (EMPC)  are  used  to  control  and  protect  the  load  circuit. 

Shown  in  Figure  4. 1.1-1  is  the  input  power  configuration  for  the  GCUs,  RTs, 
and  power  system  processors.  The  GCU  is  powered  from  the  battery  bus  and  the 
generator  it  is  controlling.  The  RTs  are  powered  from  an  AC  bus  and  a  battery 
bus . 
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The  power  system  processors  are  powered  from  two  main  AC  buses  and  also  the 
battery  bus,  to  ensure  power  Is  continuously  available  to  the  processors.  The 
ELMCs  obtain  control  power  from  the  internal  battery  bus. 

The  reliability  of  the  power  system  was  calculated  and  the  results  shown  in 
Table  4. l.l-l.  The  data  is  expressed  as  probability  of  failure,  or  loss  of 
power,  at  each  of  the  main  power  buses  and  at  the  power  buses  in  the  ELMC.  To 
meet  the  reliability  and  fault  tolerance  requirements  of  the  program,  the 
loads  are  powered  from  multiple  buses  or  ELMCs.  The  preliminary  power 
distribution  configuration  for  the  loads  is  described  in  paragraph  4.5.2. 

Shown  in  Table  4. 1.1 -2  is  the  required  reliability  of  power  to  each  category 
of  load,  flight  critical,  mission  critical,  and  nonflight  critical,  and  the 
reliability  of  power,  which  takes  into  account  redundancy,  delivered  by  the 
FTEPS. 

4.1.2  Control  System 

The  FTEPS  control  system  incorporates  a  hierarchical  control  architecture 
which  is  integrated  with  the  Vehicle  Management  System  (VMS).  This 
architecture  is  shown  in  Figure  3.3-3.  The  portion  of  the  system  shown  within 
the  dotted  line  will  be  simulated  by  the  avionics  simulator.  The  control 
system  configuration  is  shown  in  Figure  4. 1.2-1.  A  dual  redundant 
MIL-STD-1553B  data  bus  is  used  to  link  the  control  elements  of  the  FTEPS  with 
the  power  system  processors  which  function  as  data  bus  controllers,  power 
system  manager,  and  interface  to  the  avionics  syctem.  Discrete  wiring  is  used 
for  certain  critical  functions  and  for  functions  which  must  be  independent  of 
the  data  bus. 

In  Figure  4. 1.2-1,  the  external  power  control  unit  was  eliminated  (see  Figure 
3.3-1  and  3.3-2  for  original  configuration).  The  external  power  control  unit 
monitors  the  power  quality  of  the  external  power  and  controls  the  external 
power  contactors.  These  functions  have  been  incorporated  into  RT2. 
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Table  4. 1.11.  Distribution  System  Reliability 


MAIN  BUS 

PROBABILITY  OF  FAILURE 

AC  BUS 

2.10  E-6 

DC  BUS 

1.19  E-4 

BATT  BUS 

1.39E-7 

ELMC 

AC  BUS 

6.32  E-5 

DC  BUS 

6.32  E-5 

BATT  BUS 

9.71  E-9 

Table  4. 1. 1-2.  Reliability  of  Load  Power 


Probability  of  Failure 

FTEPS-Minimum 

Requirement 

Flight  Critical  Loads 

1.0  E-8 

2.5  E-5 

Mission  Critical  Loads 

1 .0  E-8 

9.9  E-5 

Non-Flight  Critical  Loads 

1 .0  E-4 

2.7  E-4 

MULTIPLEXED  DATA  BUS 


4.2 


System  Operation 


The  performance  of  FTEPS  can  be  categorized  into  five  basic  operations; 
startup,  load  control,  load  shedding,  power  quality  control,  and  fault 
protection.  System  operation  is  automatic,  requiring  no  operator 
intervention,  except  for  system  startup  from  external  power. 

4.2.1  Startup 

Three  options  are  available  for  system  startup.  The  system  startup  can  begin 
with  startup  of  the  main  aircraft  engines,  startup  of  the  SIPU,  or  application 
of  external  power  to  the  aircraft.  The  basic  starcup  procedure  is  shown  in 
Figure  4.2. 1-1.  The  main  generators  are  the  initial  source  of  electrical 
power  on  startup  from  the  aircraft  engines  or  SIPU.  The  aircraft  engines  or 
the  SIPU  provide  rotational  power  to  the  AMAD  gearboxes  on  which  the 
generators  are  mounted.  When  the  generators  reach  operational  speed,  the 
generator  is  energized  and  power  is  applied  to  the  main  power  buses, 
automatically.  This  is  controlled  by  the  generator  control  units  which 
receive  operational  power  from  the  permanent  magnet  section  of  the  generator 
and  also  from  the  battery.  When  power  is  applied  to  the  main  power  buses,  the 
remote  terminal  controlling  the  electromechanical  power  controllers  on  the  bus 
is  energized  and  will  then  apply  power  to  the  ELMCs  and  power  system 
processors.  The  control  system  is  then  initialized  and  power  applied  to  the 
aircraft  loads. 

Startup  can  be  accomplished  from  an  external  power  source.  The  procedure, 
shown  in  Figure  4.2. 1-2,  includes  a  "no  break"  power  transfer  from  external 
power  to  main  generator  power.  External  power  is  applied  to  the  external 
power  receptacle.  When  power  is  within  the  power  quality  limits,  an  external 
"power  ready"  signal  is  generated  and  the  external  power  contactor  is  closed. 
The  generator  control  unit  then  closes  the  bus  tie  breaker  (BTB)  (if  it  is 
open)  which  applies  external  power  to  the  main  power  buses.  At  this  point  the 
procedure  for  applying  power  to  the  load  is  the  same  as  a  power  up  from  the 
main  generators.  After  the  system  is  powered  up  from  external  power,  the 
engines  are  started.  When  the  generators  reach  operational  speed,  a  power 
ready  signal  is  set.  The  generator  circuit  breaker  (GCB)  then  closes. 
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paralleling  the  generator  with  the  external  power  source.  After  the  6CB 
closes,  the  external  power  contactor  opens,  disconnecting  the  external  power 
source.  The  transfer  is  accomplished  with  no  break  in  power  to  the  loads. 

4.2.2  Load  Control 

Load  control  involves  turning  power  on  or  off  to  a  load.  This  is  accomplished 
through  the  use  of  SSPCs  (or  EMPCs  for  larger  loads).  The  load  control 
process  is  shown  in  Figure  4. 2. 2-1.  The  process  begins  with  a  request  for 
power  to  a  load  or  subsystem,  generated  in  the  avionics  simulator.  This 
request  is  transmitted  to  the  power  system  processor.  The  request  is 
processed  by  the  load  control  function  which  determines  which  SSPC  or  group  of 
SSPCs  control  power  to  a  particular  load  or  subsystem  and  the  sequence,  if 
applicable,  for  turning  the  power  on.  The  power  system  processor  then 
transmits  SSPC(s)  turn-on  request(s)  to  the  appropriate  ELMC(s).  The  SSPC 
control  module  in  the  ELMC  processes  the  turn-on  request  to  determine  if  a 
priority  level  which  inhibits  the  turn-on  is  in  effect  (refer  to  paragraph 
4.2.3)  or  if  the  SSPC  is  "locked-out"  due  to  a  fault  condition.  If  either  is 
the  case,  the  SSPC  will  not  turn  on,  otherwise  it  will.  The  data  transfer 
between  the  power  system  processor  and  the  ELMC  occurs  over  the  MIL-STD-1553B 
data  bus.  The  load  control  process  is  dependent  on  the  minor  cycle  timing  of 
the  data  bus  (see  paragraph  4.3.9  for  an  explanation).  There  are  32  minor 
cycles  per  second  in  the  FTEPS.  Every  nine  minor  cycles,  the  power  requests 
are  received  from  the  avionics  simulator,  processed  by  the  power  system 
processor,  and  the  results  transmitted  to  the  ELMC  where  the  request  is 
implemented.  This  timing  is  shown  in  Figure  4. 2. 2-2.  If  a  power  request  is 
generated  and  immediately  transmitted  to  the  power  system  processor,  the  time 
delay  till  the  power  is  actually  applied  to  the  load  is  three  minor  cycles  or 
94  milliseconds.  The  worst  case  time  delay  occurs  when  the  power  request  is 
generated  right  after  the  receive  cycle,  in  which  case  the  request  must  wait 
till  the  next  receive  cycle.  This  results  in  a  maximum  delay  of  375 
milliseconds  as  shown  in  Figure  4. 2. 2-2. 
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Control  System  Functional  Diagram 


Load  Control  Timing 


4.2.3  Load  Management 


Load  management  increases  the  probability  of  mission  completion  with 
diminished  generation  capacity.  It  is  generally  accomplished  in  two  stages. 

In  the  first  stage,  after  a  system  overload  is  detected,  an  attempt  is  made  to 
relieve  the  overload  by  transferring  ELMCs  from  the  overloaded  generator 
channel  to  an  alternate.  In  the  second  stage,  if  the  overload  condition  still 
exists,  individual  loads  are  shed.  The  loads  least  critical  to  the  current 
mission  phase  are  shed  first.  The  first  stage  can  be  by-passed  if  it  will 
cause  an  overload  on  the  channel  to  which  the  ELMC  is  being  transferred. 

The  functions  involved  in  the  load  management  process  are  shown  in  Figure 
4. 2. 2-1.  The  process  begins  in  the  generator  control  unit  where  a  generator 
output  is  monitored.  The  generator  output  data  is  transmitted  over  the  data 
bus  to  the  power  system  processor.  There,  the  system  configuration  control 
function,  which  monitors  the  current  configuration  of  the  FTEPS,  processes 
this  data  and  determines  if  an  overload  exists,  the  extent  of  the  overload, 
and  the  generator(s)  which  is  overloaded.  This  information  is  transferred  to 
the  load  shedding  control  function  which  uses  this  data,  along  with  mission 
phase  data  from  the  avionics  simulator,  to  determine  if  the  first  or  second 
stage  should  be  implemented.  If  the  first  stage  is  implemented  and  the 
overload  condition  is  not  relieved,  stage  two  is  implemented. 

The  implementation  of  the  load  shedding  stage  involves  the  selection  of  a  load 
management  priority  level.  There  are  sixteen  priority  levels  as  shown  in 
Figure  4. 2. 3-1.  There  are  multiple  levels  for  each  mission  phase.  Normally, 
the  load  management  level  is  set  to  1,  i.e.,  all  loads  enabled  for  flight 
operation.  In  any  of  the  other  levels,  only  those  loads  critical  to  a 
particular  mission  phase  are  enabled.  Multiple  levels  are  available  for  each 
missiun  phase,  each  level  representing  a  different  power  level.  This  allows 
the  mission  load  to  be  matched  more  accurately  with  the  generation  capacity  of 
the  system. 

The  load  management  process  is  time  constrained  by  the  data  bus  timing.  Tne 
data  bus  timing  is  based  on  32  minor  cycles  per  second.  This  is  described  in 
detail  in  paragraph  4.3.9.  Shown  in  Figure  4. 2. 3-2  is  the  minor  cycle  timing 
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for  the  load  management  function.  System  status  data,  which  includes 
configuration  and  generator  load  information,  is  received  and  processed  by  the 
power  system  processor  every  three  minor  cycles.  If  an  overload  occurs  just 
after  status  information  iias  been  received  by  the  power  system  processor,  the 
overload  information  must  then  wait  for  three  minor  cycles  till  the  next 
receive  cycle.  This  is  the  maximum  delay  in  detecting  an  overload.  Once  an 
overload  is  detected,  a  469  millisecond  time  delay  is  enacted  before  action  is 
taken.  This  is  to  ensure  the  overload  condition  is  not  a  transient 
condition.  At  the  end  of  the  time  delay,  an  ELMC  transfer  or  load  shed  will 
occur.  System  status  is  continuously  monitored  and,  if  after  281  milliseconds 
the  overload  still  exists,  load  shedding  will  be  implemented.  If  it  had 
already  been  implemented,  the  priority  level  is  changed  to  further  decrease 
the  load. 

4.2.4  Power  Quality  Control 

Power  quality  is  provided  per  MIL-STD-704C.  Jhe  power  quality  control  is 
provided  at  two  levels  in  the  system,  at  the  main  power  buses  and  at  the 
ELMC.  The  generator  control  units  monitor  and  control  power  quality  at  the 
main  power  buses.  The  functions  of  the  generator  control  units  a^e  described 
in  paragraph  4.3.1.  The  ELMC  functions  to  minimize  undervoltages  at  the 
loads.  This  is  accomplished  by  transferring  the  ELMC  loads  from  one  power  bus 
which  is  below  the  voltage  limits,  to  another  power  bus  which  is  within 
limits.  The  ELMC  functions  are  described  in  paragraph  4.3.3. 

4.2.5  Fault  Protection 

A  primary  function  of  the  FTEPS  is  fault  protection.  Fault  protection  is 
provided  by  differential  fault  current  protection  circuits,  electromechanical 
power  controllers  (EMPC),  and  solid  state  power  controllers  (SSPC).  The 
generator  feeders  and  main  AC  power  buses  are  protected  by  differential  fault 
current  protection  circuits,  generally  referred  to  as  differential  protection 
or  DP.  The  EMPCs  are  used  to  protect  the  distribution  feeders  and  load 
feeders  tc  large  loads.  The  SSPCs  are  used  to  protect  the  majority  of  load 
t'eedei  s . 


DP  utilizes  current  transformer  loops  to  detect  fault  currents.  When  fault 
currents  are  detected,  the  faults  are  cleared  by  isolating  and  switching  power 
off  to  that  part  of  the  circuit.  The  DP  networks  are  shown  in  Figure 
4. 2. 5-1.  There  are  two  types  of  DP  networks,  a  generator  DP  network  and  a 
sync  bus  DP  (SBDP)  network.  The  generator  DP  network  covers  two  zones.  Zone 
1  is  the  converter  and  feeder  to  the  main  bus.  Zone  2  is  the  main  bus. 

Faults  in  Zone  1  are  cleared  by  opening  the  GCB.  Faults  in  Zone  2  are  cleared 
by  opening  the  GCB  and  BTB.  The  SBDP  network  covers  the  sync  bus,  the  wiring 
interconnecting  the  BTBs  and  EPC.  Faults  on  the  sync  bus  are  cleared  by 
opening  the  BTBs  and  EPC. 

The  EMPCs  and  SSPCs  are  used  to  protect  distribution  and  load  feeders  and  are 
described  in  paragraphs  4.3.4  and  4.3.5,  respectively.  These  devices  sense 
current.  When  fault  current  levels  are  detected  the  device  opens  the  circuit 
with  a  switch,  solid  state  in  the  case  of  the  SSPC.  The  EMPCs  are  used  in 
circuits  of  ten  amps  or  greater,  while  the  SSPCs  are  used  in  circuits  less 
than  ten  amps. 

4.3  Hardware  Description 

4.3.1  Generators 

The  FTEPS  generation  system  consists  of  four  40/60  KVA,  115V,  400Hz  variable 
speed  constant  frequency  (VSCF)  generators  operated  in  a  split  parallel 
configuration.  The  generators  are  mounted  on  and  driven  by  two  airframe 
mounted  accessory  drives  (AMAD).  Auxiliary  and  emergency  power  is  provided  by 
a  super  integrated  power  unit  (SIPU)  which  drives  the  AMADs  through  an  angle 
gear  box  and  clutches  as  shown  in  Figure  4. 1.1-2. 

The  VSCF  generators  are  DC  link  machines  capable  of  generating  60  KVA  each 
continuously  and  85  KVA  for  five  minutes.  The  generators  are  connected  in  the 
configuration  shown  in  Figure  4. 3. 1-1.  The  generators  produce  an  ac  voltage 
which  is  rectified  to  dc  and  fed  to  the  converter.  The  converter  inverts  this 
dc  voltage  to  produce  a  constant  400  Hz,  115  VAC  output.  Two  generators  are 
driven  by  each  AMAD  with  generators  on  opposite  AMADs  paralleled  through  the 
bus  tie  breakers  (BTB)  as  shown  in  Figure  4. 3. 1-1.  This  split  parallel 
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concept  allows  the  FTEPS  to  support  large  loads  such  as  the  environmental 
control  system  and  integrated  actuator  packages  without  degradation  of  power 
quality. 

Each  generator/converter  channel  is  controlled  by  a  generator  control  unit 
(GCU).  A  GCU  functional  diagram  is  shown  in  Figure  4. 3. 1-2. 
Generator/converter  interfaces  with  the  GCU  are  shown  as  well  as  interfaces 
with  the  external  power  monitor,  differential  current  protection  (DP)  loops, 
the  FTEPS  control  console,  and  the  FTEPS  MIL-STD-1553B  data  bus.  The  GCU 
power  quality  protective  functions  and  trip  parameters  are  shown  in  Figure 
4. 3. 1-3.  The  trip  functions  are  broken  up  as  to  generator  circuit  breaker 
(GCB)  trips  and  bus  tie  breaker  (BTB)  trips.  The  GCU  controls  and  monitors 
the  BTB  and  GCB  through  a  hardwire  interface.  External  power 
point-of-regulation  (POR)  voltage  is  provided  to  the  GCU  through  a  hardwire 
interface  to  allow  the  GCU  to  synchronize  the  generating  channel  with  external 
power  for  no  break  power  transfer  between  ship's  power  and  external  power. 

The  GCU  provides  fault  current  protection  by  monitoring  the  generator  DP  loop 
and  the  synchronizing  bus  DP  loop.  The  GCU  interfaces  with  the  generator  and 
BTB  control  switches  on  the  control  console  to  provide  optional  manual  control 
of  the  generator  and  the  BTB.  The  GCU  also  interfaces  with  the  power  system 
processors  over  the  MIL-STD-1553B  data  bus  to  provide  generation  system 
status,  DP  status,  and  built-in  test  information  to  the  power  system 
processors. 

The  GCUs  control  the  synchronization  and  paralleling  of  generators.  All 
generators  are  constantly  synchronized  by  the  master  frequency  reference 
provided  by  GCU  1.  Modes  of  parallel  operation  include  all  four  generators 
paralleled  with  external  power  during  no  break  power  transfer  at  startup, 
split  parallel  operation  during  power  up  without  external  power,  normal  split 
parallel  operation,  and  all  four  generators  paralleled  with  external  power 
during  power  down  to  external  power.  No  bus  power  control  unit  is  used  in  the 
FTEPS  system  therefore  external  power  must  be  monitored  by  a  remote  terminal 
which  will  provide  an  external  power  ready  signal  to  the  GCUs  and  control  the 
external  power  contactor  on  request  from  the  GCU. 
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LIMITS 

FUNCT  K)N 

TYPE  Ol 

SENSING 

TRIPPING  PARAMETER 

TIMED  DELAY 
SECONDS 

GFS  A  t*  B  TRIP  FUNCTIONS 

Overvoltage  (OV| 

Undervoltage  1 UV 1 

Underfrequracy  (UF) 

Overfrequency  (OF) 

Differential  Protection  (DPI  1 
Extraneous  Frequency  (EF2l 

IK'  Content  (DCC2) 

Average 

Low  Phase 

One  Phase 

One  Phase 

CT  Loop 

High  Phase 

High  Phase 

122  ♦  3  Volts 

106.5  ♦  2.5  Volts 

385  v  5  Hr 

415  t  5  Hr 

20+5  Amps 
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Figure  4.3. 1-3.  GCU  Protective  Functions 
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The  GCU  protects  the  generating  channel  against  feeder  faults  by  monitoring 
two  DP  loops.  The  generator  DP  loop  as  shown  in  Figure  4. 3. 1-1  senses  faults 
in  the  feeder  from  the  converter  to  the  main  bus  including  the  main  bus 
itself.  The  synchronizing  bus  DP  loop  senses  faults  in  the  feeder  between  the 
main  buses.  Figure  4.3. 1-4  shows  a  typical  DP  loop  where  a  power  feeder  is 
passed  through  two  current  transformers.  If  a  fault  occurs  in  the  feeder 
anywhere  between  the  current  transformers,  a  voltage  is  developed  across  the 
resistor  R.  This  voltage  is  the  DP  loop  fault  signal  sent  to  the  GCU.  If  a 
fault  occurs  in  the  generator  DP  zone,  the  GCB  is  tripped.  If  this  GCB 
tripping  action  clears  the  fault,  no  further  action  is  taken.  If  the  GCB  trip 
does  not  clear  the  fault,  the  BTB  is  then  tripped.  If  a  fault  occurs  in  the 
synchronizing  bus  zone,  the  BTBs  at  either  end  of  the  synchronizing  bus  are 
tripped. 

Two  switches  for  each  generating  channel  will  be  located  on  the  FTEPS  control 
console  and  will  provide  manual  control  of  the  generator  and  the  BTB.  The 
generator  control  switch  is  a  single-pole,  double-throw  switch  with  "on"  and 
"off"  positions.  The  GCB  is  closed  and  power  is  delivered  to  the  main  bus 
provided  the  voltage  and  frequency  are  within  limits  and  the  generator  control 
switch  is  in  the  "on"  position.  Moving  the  generator  control  switch  to  the 
"off"  position  trips  the  GCB  and  de-energizes  the  generator  channel.  The  BTB 
switch  is  a  single-pole  switch  with  momentary  "on"  and  momentary  "off" 
positions.  The  momentary  "on"  position  closes  the  BTB  if  no  trip  signal 
exists  and  resets  the  GCU's  BTB  auto  close  lock-out.  The  momentary  "off" 
position  trips  the  BTB  and  sets  the  GCU's  BTB  auto  close  lock-out. 

A  MIL- STD- 1 553 B  bus  interface  unit  is  included  in  the  GCU  to  allow  the  GCU  to 
transmit  generating  system  status  and  built-in-test  information  to  the  FTEPS 
power  system  processors  over  the  FTEPS  MIL- STD-1553B  data  bus.  Data  to  be 
transmitted  over  the  MIL- STD- 1 553B  data  bus  by  the  GCU  to  the  power  system 
processors  include  generator  on/off  status,  GCB  open/close  status,  BTB 
open/close  status,  generator  current,  and  oil  temperature.  The  generating 
system  is  autonomous  and  therefore  no  control  commands  are  needed  from  the 
power  system  processors  to  the  GCUs. 
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4.3.2 


Batteries 


Preliminary  performance  requirements  for  the  battery  system  have  been 
developed  based  on  a  two  hour  mission.  These  include  start-up,  emergency  and 
transient  power  conditions  along  with  recharging  conditions.  Load  voltage 
requirements  are  per  MI L- STD-704C .  Lead  acid  batteries  are  used  because  they 
require  low  maintenance  and  they  can  be  float  charged. 

The  first  requirement  the  battery  system  must  meet  is  to  supply  2515  watts  for 
a  five  minute  ground  start-up  with  a  minimum  of  16  volts  ( starting/ emergency 
limit)  supplied  at  the  loads.  The  second  requirement  is  to  supply  3210  watts 
for  a  ten  minute  emergency  situation  with  16  volts  (starting/emergency  limit) 
minimum  at  the  loads.  The  system  must  also  be  able  to  supply  3300  watts  for 
five  one  second  transient  (switching)  conditions  with  a  20  volt  (transient 
limit)  minimum  load  requirement.  Finally,  the  battery  system  must  be  fully 
recharged  within  the  two  hour  mission  if  no  emergency  situation  arises. 

An  analysis  was  conducted  to  evaluate  the  performance  of  two  24  volt,  26  Ah 
Gates  sealed  lead-acid  batteries  under  these  conditions.  The  analysis  is 
summarized  in  Table  4. 3. 2-1  and  shows  that  all  the  above  requirements  can  be 
met  by  the  two  Gates'  batteries.  These  batteries  can  deliver  2515  watts  for  a 
five  minute  ground  start  up  as  shown  in  Figure  4. 3. 2-1.  Figure  4. 3. 2-2  shows 
the  worst  case  battery  voltage,  component  voltage  drop,  wire  voltage  drop  and 
load  voltage.  For  start  up,  a  21  volt  minimum  is  supplied  at  the  loads. 
Figures  4. 3. 2-3  and  4. 3. 2-4  show  the  effects  of  imposing  3210  watts  of 
emergency  load  on  the  batteries.  In  Figure  4. 3. 2-3,  the  batteries  will 
deliver  13  minutes  of  power  at  the  emergency  load  rate  after  charging  for 
approximately  one  hour.  During  take-off  when  the  batteries  have  not  been 
recharged,  as  in  Figure  4. 3. 2-4,  they  will  deliver  emergency  load  power  for  9 
minutes.  Figure  4. 3. 2-2  shows  that  the  load  voltage  at  the  end  of  an 
emergency  situation  is  17  volts.  These  batteries  can  also  deliver  3300  watts 
for  five  one  second  transient  emergency  conditions  as  shown  in  Figure  4. 3. 2-1, 
with  21  volts  minimum  shown  in  Figure  4. 3. 2-2.  Finally,  Figure  4. 3. 2-1  shows 
that  the  two  batteries  can  be  fully  recharged  withii  the  mission  time.  By 
paralleling  two  75  ampere  TKU's  per  battery,  the  recharge  time  is 


•  ANALYSIS  BASED  ON: 

•  2-24V  26.0  Ah  GATES  BATTERIES,  SEALED  LEAD  ACID 
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Figure  4.3. 2-4.  Batten  Load  Characteristics  -  Emergency 
Operation  Without  Charging 
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approximately  one  hour.  Each  set  of  paralleled  TRU's  must  provide  70  amperes 
at  27.5  volts  to  achieve  the  one  hour  recharge  time.  By  changing  the  tap 
settings  on  the  TRU's,  the  recharge  time  can  be  increased  or  decreased. 

4.3.3  Electrical  Load  Management  Center  (ELMC)  Hardware  Description 

The  ELMC  is  a  distributed  load  center  with  processing  capability.  There  are 
four  ELMCs  in  the  system.  Each  ELMC  contains  up  to  100  Solid-State  Power 
Controllers  (SSPCs)  to  provide  the  distributed  load  control  and  protection  and 
contains  a  MIL-STD-1750A  16-bit  central  processing  unit  (CPU)  to  provide  the 
local  load  management.  Two  AC  power  buses,  two  DC  power  buses,  and  a  battery 
power  bus  are  brought  to  each  ELMC.  An  AC  and  a  DC  transfer  relay  select 
between  each  of  the  two  sets  of  power  buses,  under  control  of  the  CPU. 

Voltage  sensors  provide  voltage  information  from  the  power  buses  to  the  CPU. 

Figure  4. 3. 3-1  shows  the  functional  block  diagram  of  an  ELMC,  Figure  4. 3. 3-2 
shows  the  internal  power  distribution  of  an  ELMC,  and  Figure  4. 3. 3-3  shows  a 
hardware  concept  where  the  SSPCs  are  individually  replaceable. 

4.3.3. 1  Functional  Description 

The  heart  of  an  ELMC  is  its  MIL-STD-1750A  processor.  Operating  under  software 
control,  the  CPU  configures  the  SSPCs  and  transfer  relays  contained  in  the 
ELMC  based  on  commands  from  the  PSP,  power  bus  voltages,  and  the  state  of  the 
emergency  mode  select. 

Commands  are  received  from,  and  status  sent  to,  the  PSP  over  the  FTEPS 
dual-redundant  MI L-STD- 1 553B  serial  digital  data  bus.  A  bus  interface  unit 
(BIU)  interfaces  the  data  bus  to  the  CPU  and  memory.  Analog-to-digital  (A/D) 
converters  allow  monitoring  of  the  power  bus  voltages  and  the  diode  status  of 
the  two  diodes  feeding  the  flight-critical  power  bus.  Hardwired  discrete 
inputs  (interrupts)  from  the  electrical  system  control  panel  allow  emergency 
configuring  of  the  ELMC  to  one  of  several  predefined  modes. 
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Figure  4.3.3- 1.  Electrical  Load  Management  Center  Functional  Block  Diagram 
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Figure  4.3  3-2.  Electrical  Load  Management  Center  Internal  Power  Distribution 
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The  CPU  controls  the  transfer  relays  by  means  of  a  discrete  I/O  interface 
(buffered  latch)  with  relay  driving  circuits.  The  CPU  interface  to  the  SSPCs 
consists  of  an  open/close  command  signal  to  each  SSPC,  and  open/closed/tripped 
status  data  back  crom  each  SSPC. 

A  power  supply  operating  off  the  flight-critical  power  bus  provides  all  of  the 
internal  operating  power  for  the  ELMC . 

4. 3. 3. 2  Power  Distribution 

Based  on  the  particular  power  configuration  commanded  by  the  PSP,  or  selected 
by  the  emergency  mode  select,  and  the  voltages  of  the  power  buses,  the  AC 
transfer  relay  supplies  the  ELMC  AC  power  distribution  bus  from  one  of  the  two 
AC  power  buses  supplying  the  ELMC.  The  DC  transfer  relay  operates  in  a 
similar  way.  The  ELMC  flight-critical  power  distribution  bus  is  supplied  from 
both  the  ELMC  DC  power  bus  and  the  battery  bus,  each  with  an  in-line  diode  to 
provide  isolation. 

4. 3. 3. 3  Enclosure  Concept 

The  concept  for  an  ELMC  enclosure  provides  for  easy  replacement  of  individual 
or  related  groups  of  SSPCs  in  a  standard  ATR-type  enclosure. 
Zero-insertion-force  cam-lock  type  card  edge  retainers  provide  easy 
replacement,  positive  holding  power,  and  good  thermal  conductivity  to  the  case 
for  the  SSPCs  as  well  as  the  other  circuitry  modules  (CPU,  BIU,  interfaces, 
power  supply).  Area  for  connector  wire  integration,  diodes,  and  transfer 
relays  is  also  provided.  Due  to  the  amount  of  heat  generated,  forced-air 
cooling  is  required. 

4.3.4  Solid  State  Power  Controllers 

Solid  state  power  controllers  (SSPC)  are  used  to  provide  control  and  feeder 
protection  for  loads  from  3.0  to  7.5  amperes  at  115V  AC  400  Hz  and  28  VDC. 

The  SSPCs  consist  of  a  control  and  logic  section,  the  solid  state  switching 
section,  and  the  current  sense  section.  The  control  and  logic  section 
receives  command  signals  from  the  ELMC  and  drives  the  switching  section  to 


open  or  close  based  on  the  command  received.  The  control  and  logic  command 
provides  a  status  and  trip  siqnal  to  the  ELMC  based  on  the  state  of  the  SSPC 
and  information  received  from  the  current  sense  section.  The  current  sense 
section  determines  the  magnitude  of  the  current  to  the  load  and  provides  a 
trip  signal  to  the  control  and  logic  section  if  an  overcurrent  condition 
exists . 

The  SSPC  hardware  configuration  is  shown  in  Figure  4.3.4.  The  SSPC  is  mounted 
on  a  2  inch  by  3  inch  circuit  card.  A  connector  is  provided  on  one  edge  of 
the  card  to  allow  the  card  to  be  plugged  into  a  card  rack.  Both  signal 
interface  and  power  interface  is  provided  through  this  single  connector.  Heat 
is  dissipated  to  the  card  rack  through  the  card  edge  to  card  rack  interface. 
SSPC  ratings  include  3A,  5A,  and  7.5A  in  both  28  VDC  and  115  VAC,  400  Hz.  The 
voltage  drop  across  the  SSPC  is  limited  to  IV  for  the  AC  device  and  0.5  V  for 
the  DC  device.  Rupture  current  through  the  SSPC  when  operating  into  short 
circuit  is  limited  by  either  an  instant  trip  feature  or  current  limiting. 

4.3.5  Electromechanical  Power  Controllers 

Loads  larger  than  7.5  amps  per  phase  require  electromechanical  power 
controllers  to  provide  load  switching  and  fault  current  protection.  The 
concept  developed  for  the  FTEPS  electromechanical  power  controller  (EMPC)  is 
shown  in  Figure  4.3.5.  The  EMPC  consists  of  mechanical  contacts,  control  and 
logic  circuitry,  and  a  current  sense  element.  The  mechanical  contacts  provide 
the  physical  switching  to  open  and  close  the  power  circuit  to  the  load.  These 
contacts  are  controlled  by  the  control  and  logic  section  which  responds  to 
commands  from  a  remote  terminal.  The  EMPC  interfaces  with  the  remote  terminal 
through  discrete  control,  status,  and  trip  lines.  Controller  status,  trip, 
and  fault  information  is  fed  back  to  the  remote  terminal  to  allow  the  remote 
terminal  to  transmit  this  information  to  the  FTEPS  power  system  processors 
over  the  MIL-STD-1 553B  data  bus.  The  current  sense  element  provides  the 
current  magnitude  to  the  control  and  logic  portion  to  enable  the  EMPC  to  trip 
in  the  event  of  a  faulted  load  or  load  feeder.  The  EMPC  trip  curve  is 
tailored  to  provide  thermal  protection  for  the  wire. 
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Figure  4.3.4.  Solid  State  Power  Controller  Hardware  Configuration 
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4.3.6  Remote  Terminal  (RT)  Hardware  Description 

There  are  four  RTs  in  the  system.  Each  RT  interfaces  with  up  to  50 
Electromechanical  Power  Controllers  (EMPCs)  to  provide  the  distributed  load 
control  and  protection.  Each  RT  contains  a  MIL- STD- 1 750A  16-bit  central 
processing  unit  (CPU)  to  provide  the  local  load  management.  Voltage  sensors 
provide  voltage  information  from  the  power  buses,  battery,  diodes,  and 
transformer-rectif ier  unit  (TRU)  to  the  CPU.  In  addition,  RT  2  controls  the 
external  power  contactors  (EPCs)  in  conjunction  with  the  Generator  Control 
Units  (GCUs) . 

Fiqure  4. 3. 6-1  shows  the  functional  block  diagram  of  an  RT,  and  Figure  4. 3. 6-2 
shows  the  functional  block  diagram  of  RT  2  which  incorporates  the  external 
power  control . 

4.3.6. 1  Functional  Description 

The  heart  of  an  RT  is  its  MIL-STD-1 750A  processor.  Operating  under  software 
control,  the  CPU  configures  the  EMPCs  based  on  commands  from  the  PSP,  power 
bus  voltages,  and  the  state  of  the  emergency  mode  select. 

Commands  are  received  from,  and  status  sent  to,  the  PSP  over  the  FTEPS 
dual -redundant  MIL-STD-1 553B  serial  digital  data  bus.  A  bus  interface  unit 
(BIU)  interfaces  the  data  bus  to  the  CPU  and  memory. 

Analog-to-di gi tal  (A/D)  converters  al low  monitoring  of  the  power  bus  voltages, 
battery  state-of-charqe ,  TRU  status,  and  diode  status.  Hardwired  discrete 
inputs  (interrupts)  from  the  electrical  system  control  panel  allow  emergency 
configuring  of  the  RT  to  one  of  several  predefined  modes. 

The  RT  interface  to  the  EMPCs  consists  of  an  open/close  command  signal  to  each 
EMPC,  and  open/closed/trip  status  data  back  from  each  EMPC. 

A  power  supply  operating  off  dual  input  sources  provides  all  of  the  internal 
operating  power  for  the  RT. 
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4.3.6.?  External  Power  Control 

In  addition  to  the  above  functions,  RT  2  provides  control  of  the  external 
power  contactors  in  conjunction  with  the  GCUs. 

The  RT  2  power  supply  receives  an  additional  input  from  the  external  power 
bus,  so  that  the  RT  can  be  powered  up  before  the  aircraft  is.  RT  2  monitors 
the  external  power  quality  (voltage  and  frequency),  and  then  sends  a  hardwired 
discrete  signal  to  the  GCUs  indicating  that  external  power  is  ready.  When  the 
GCUs  are  ready,  they  return  a  low  on  the  hardwired  external  power  trip 
signals,  indicating  to  RT  2  to  close  the  external  power  contactors.  When  the 
generators  are  up  and  paralleled,  the  GCUs  return  a  high  on  the  external  power 
trip  signals,  indicating  to  RT  2  to  trip  out  the  external  power  contactors. 

RT  2  also  monitors  the  positions  of  the  generator  control  breakers  (GCBs)  and 
the  bus  tie  breakers  (BTBs). 

4.3.7  Power  System  Processors 

The  PSPs  provide  overall  control  of  the  electrical  power  system.  In  order  to 
provide  greater  reliability,  a  two  processor  configuration  is  used.  Each  of 
the  PSPs  will  implement  the  MIL-STD-1 750A  Instruction  Set  Architecture,  and  be 
capable  of  operating  as  either  the  master  bus  controller  or  as  a  remote 
terminal  on  the  MIL-STD-1 553B  data  bus. 

Figure  4.3.7  shows  the  functional  block  diagram  of  a  PSP  with  the  following 
major  components: 

o  Power  supply 

o  Central  Processing  Unit  (CPU) 
o  Memory 

o  Memory  Management  Unit  (MMU) 

o  Discrete  I/O 

o  MIL-STD-1553B  interface 

o  RS-422  serial  interface 
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figure  4. 3. 7  Power  System  Processors 
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Each  of  the  PSPs  will  be  able  to  operate  from  any  one  of  three  power  sources. 
These  will  consist  of  two  115V  AC  3-phase  power  sources  as  well  as  a  24  volt 
battery.  The  power  supply  will  operate  on  input  power  which  meets  the 
requirements  of  MIL-STD-704C . 

The  PSPs  will  also  contain  an  internal  RAM  memory  of  at  least  64k  16  bit  words 
with  the  option  of  expanding  up  to  1  MEG  words  with  t*'e  use  of  the  software 
selectable  MMU.  The  MMU  and  the  CPU  will  be  the  Fairchild  F9451  and  F 9450 
chips,  respectively. 

Furthermore,  discrete  I/O  will  be  available  to  provide  communications  between 
the  two  PSPs  and  also  between  the  PSPs  and  the  Avionics  Simulator.  There  will 
be  a  Go/No  Go  pair  of  discrete  links  between  the  PSPs  which  will  enable  one  of 
the  PSPs  to  maintain  bus  control.  In  addition,  it  will  ensure  that  both  PSPs 
are  not  trying  to  assert  bus  control  simultaneously.  The  discrete  links  to 
the  Avionics  Simulator  will  allow  the  Avionics  Simulator  to  determine  which 
PSP  is  the  active  bus  controller,  and  thus  which  PSP  it  should  be  transmitting 
and  receiving  data  from.  An  RS-422  serial  interface  will  provide  for  data 
communications  between  the  PSPs  and  the  Avionics  Simulator.  Tne  PSP  that  is 
not  functioning  as  the  bus  controller  will  operate  as  a  backup  bus  controller 
in  the  remote  terminal  mode. 

The  PSPs  w'll  be  provided  with  an  interface  for  a  dual  redundant  MIL-STD-1 553B 
data  bus.  They  will  be  able  to  act  as  either  a  bus  controller  or  a  remote 
terminal.  The  Bus  Interface  Unit  (BIU)  will  have  direct  memory  access,  and 
will  be  capable  of  addressing  up  to  64k  words  of  memory.  The  BIU  will  perform 
all  the  bus  control  functions  for  the  PSP  including  encoding  and  decoding  of 
signals  over  the  data  bus,  coding  validation,  word  identification,  and  direct 
mapping  of  data  into  memory. 

4.3.8  Avionics  Simulator 

The  avionics  simulator  functions  as  the  aircraft  avionics  suite  by  simulating 
the  processing,  control,  and  status  monitoring  an  actual  avionics  system  would 
perform  with  respect  to  the  FTEPS.  These  functions  include  FTEPS  status 
processing,  avionics  load  control,  aircraft  flight  phase  processing,  and  FTEPS 
status  display  control. 
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The  avionics  simulator  hardware  shown  in  Figure  4.3.8  consists  of  a  Digital 
Equipment  Corporation  MicroVax  II,  a  monochrome  display  terminal,  and  a  color 
graphics  terminal.  The  MicroVax  II  performs  all  the  processing  required  of 
the  avionics  simulator.  User  interface  is  provided  by  the  two  terminals  with 
the  monochrome  display  terminal  functioning  as  the  medium  for  avionics 
simulator  control  and  the  color  graphics  terminal  functioning  as  the  simulated 
cockpit  display  for  the  FTEPS  control  console.  Operator  inputs,  manual  FTEPS 
load  requests,  manual  flight  phase  requests,  and  display  requests  are 
performed  by  the  system  operator  at  the  monochrome  display  terminal.  FTEPS 
status  data  as  would  be  seen  in  an  aircraft  cockpit  are  displayed  on  the  color 
graphics  terminal. 

The  avionics  simulator  interfaces  with  the  FTEPS  power  system  processors  over 
two  RS-422  serial  data  buses  and  two  hardware  links.  Information  transmitted 
over  the  RS-422  avionics  simulator  to  the  power  system  processors  includes 
load  requests  and  flight  phase  status.  Information  passing  from  the  power 
system  processors  to  the  avionics  simulator  includes  system  configuration 
status,  load  status,  and  maintenance  data.  The  two  hardwired  interfaces  are 
included  to  transmit  power  system  processor  status  to  enable  the  avionics 
simulator  to  determine  which  power  system  processor  is  active  and  which  is  the 
backup. 

4.3.9  Data  Bus 

The  preliminary  data  flow  requirements  for  the  FTEPS  MIL-STD-1553B  data  bus 
have  been  defined.  All  bus  traffic  will  be  of  the  form  bus 
control ler-to-remote  terminal  or  remote  terminal-to-bus  controller,  with  one 
of  the  Power  System  Processors  (PSPs)  acting  as  bus  controller.  No  broadcast 
or  remote  terini nal -to-remote  terminal  transmissions  will  be  allowed.  The  dat 
bus  system  includes  a  total  of  13  remote  terminals,  consisting  of  four  ELMCs, 
four  GCUs,  four  RTs,  and  the  standby  PSP.  Remote  terminal  addresses  have  been 
established  for  each  of  these  elements  on  the  MIL-STD-1553B  bus,  and  are  shown 
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Thp  time  available  for  data  transmission  over  the  MIL-STD- 1 S53B  data  bus  has 
been  broken  down  into  major  and  minor  frames.  The  major  frame  represents  the 
lowest  frequency  of  repetition  with  all  periodic  events  happening  at  least 
once  during  the  course  of  every  major  frame.  The  major  frame  is  281.25  msec 
long,  and  is  divided  into  nine  distinct  minor  frames,  or  cycles.  Each  minor 
cycle  contains  a  fixed  sequence  of  events.  These  events  are  the  scheduled 
mode  code  commands  and  messages  necessary  for  proper  performance  of  the 
electric  power  system.  There  are  32  minor  cycles  per  second. 

The  data  transmitted  over  the  bus  has  been  identified  and  packed  into  data 
word  and  message  formats  as  shown  in  Tables  4. 3. 9-1  and  4. 3. 9-2.  A 
methodology  for  documenting  these  formats  has  been  developed  in  the  Interface 
Control  Document  (ICD)  for  the  Fault  Tolerant  Electrical  Power  System.  In 
addition,  message  transmission  rates  have  been  determined,  and  the  messages 
have  been  assigned  to  various  minor  cycles  as  shown  in  Figure  4. 3. 9-2. 

Two  types  of  transfers  occur  over  the  MIL-STD-1553B  data  bus,  namely 
synchronous  and  asynchronous  transmissions.  Synchronous  transmissions  are  the 
most  common  and  consist  of  the  scheduled  data  and  mode  code  transmissions. 
Asynchronous  transmissions  consist  of  error  and  exception  handling  routines. 

Synchronous  Transmissions 

There  are  two  rates  of  data  transmission:  data  transmitted  once  every  nine 
minor  cycles,  or  once  a  major  frame  (3.5  Hz);  and  data  transmitted  once  every 
three  minor  cycles,  or  three  times  a  major  frame  (10.7  Hz).  The  messages  sent 
at  a  frequency  of  3.5  Hz  consist  of: 


FMPC  status 
EMPC  commands 
SSPC  status 
SSPC  commands 
PSP  update 


Table  4. 3.9-1.  Message  Description  (PSP  Inputs ) 


MESSAGE  NAME 

SOURCE(S) 

UFSTINATION 

CONTENTS 

REPETITION  RATE 

PHASE  (MINOR  CYCLE! 

ELMC  STATUS 

ELN'Cl 

PSP 

AC  AND  DC  TRANSFER 

RELAY  POSITIONS 

AC.  DC.  AND  BATTERY 

BUS  VOLTAGES 

DIODE  STATUS 

10  7  Hj 

2.  5.  B 

GCU  STATUS 

GCUi 

PSP 

■  ..'NERATOR  ON/OF  STATUS 
BTb  OPEN/CLOSE  STATUS 
GENERATOR  CURRENT 

OIL  TEMPERATURE 

OCB  ON/OFF  STATUS 

10.7  Hz 

2.5.  8 

BT  STATUS 

RT1  AND 
RT4 

PSP 

AC  AND  DC  BUS  VOLTAGES 
TRU  ON/OFF  STATUS 

10.7  Hi 

2,5,8 

RT2  STATUS 

RT2 

PSP 

AC  AND  DC  BUS  2  VOLTAGES 
TRU  2  ON/OFF  STATUS 
BATTERY  8US  1  VOLTAGE 
BATTERY  1  STATE  OF 
CHARGE  DIODE  STATUS 
EXTERNAL  POWER 
CONTACTOR  POSITIONS 

10.7  Hi 

2.5.8 

RT3 STATUS 

RT3 

PSP 

AC  ANO  OC  BUS  3  VOLTAGES 
TRU  3  ON/OFF  STATUS 
BATTERY  BUS  2  VOLTAGE 
BATTERY  2  STATE  OF 
CHARGE  DIODE  STATUS 

10  7  Hi 

2.5.8 

SSPC  STATUS 

ELMC. 

PSP 

SSPC  ON/OFF.  AND  TRIP 
STATUS 

3B  Hi 

5 

EMPC  STATUS 

RTi 

PSP 

EMPC  ON/OFF.  AND  TRIP 
STATUS 

3.6  Hi 

5 
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Table  4. 3. 9-2.  Message  Description  (PSP  Outputs ) 


MESSAGE  NAME 

SOURCE 

OESTINATIONISI 

CONTENTS 

REPETITION  RATE 

PHASE  (MINOR  CYCLEI 

ELMC  RELAY 

PSP 

ELMC. 

AC  ANO  DC  TRANSFER 
RELAY  COMMANDS 
PRIORITY  LEVEL 

10.7  Hi 

1,4,7 

PRIORITY-  LEVEL 

PSP 

RTi 

PRIORITY  LEVEL 

10.7  Hz 

1.4.7 

PSP  UPOATE 

PSP 

BACKUP 

PSP 

TBD 

3.8  Hz 

6 

SSPC  COMMANDS 

PSP 

ELIUCi 

SSPC  ON/OFF 
COMMANDS 

3.6  Hz 

3 

EMPC  COMMANDS 

PSP 

RT. 

EMPC  ON/OFF 
COMMANDS 

3.6  Hz 

3 
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Messages  sent  at  a  frequency  of  10.7  Hz  consist  of  the  following: 

o  ELMC  commands 

o  RT  commands 

o  ELMC  status 

o  RT  status  {message  formats  differ  for  the  individual  RTs) 

o  GCU  status 

In  addition  to  the  data  transmissions,  time  must  be  reserved  to  accommodate 
mode  code  overhead.  There  will  be  two  primary  mode  code  messages  sent  over 
the  %ita  bus.  The  first  is  the  synchronization  mode  code.  This  mode  code  is 
sent  out  at  the  beginning  of  each  minor  cycle  (32  Hz)  from  the  bus  controller 
to  each  of  the  remote  terminals.  The  purpose  of  this  mode  code  is  to 
initialize  the  remote  terminals  to  the  proper  minor  cycle  count. 

The  second  scheduled  mode  code  will  be  a  request  status  word  mode  code  to  the 
GCUs.  This  mode  code  will  be  sent  out  three  times  a  minor  cycle  (96  Hz),  to 
check  for  a  differential  protection  (DP)  fault.  If  a  fault  has  occurred,  it 
will  be  indicated  by  setting  the  service  request  bit  in  the  status  word  to 
"1".  The  bus  controller's  Bus  Interface  Unit  (BIU)  will  look  at  the  status 
word  and  in  the  event  that  a  DP  fault  is  detected  the  Central  Processing  Unit 
(CPU)  will  be  interrupted  and  an  asynchronous  message  will  be  sent  to  the 
ELMCs.  Otherwise,  no  action  will  be  taken  and  the  bus  controller  will 
continue  on  with  its  normal  sequence  of  events. 

Asynchronous  Transmissions 

Asynchronous  message  transmissions  occur  as  the  result  of  error  conditions.  A 
device  failure  or  an  error  during  message  transmission  will  cause  the  bus 
controller  to  either  automatically  retry  transmitting  the  message  or  interrupt 
the  CPU  to  initiate  some  other  type  of  error  handling  routine.  This  may 
involve  asking  for  Built  In  Test  (BIT)  information  from  the  remote  terminal  in 
question  or  switching  to  the  alternate  bus.  When  a  DP  fault  is  detected  the 
BIU  will  interrupt  the  CPU  and  the  normal  sequence  of  events  will  be  halted. 

An  asynchronous  message  will  be  sent  to  the  ELMCs  instructing  them  to  take 
some  desired  action.  After  the  message  has  been  sent,  normal  operations  will 


resume. 


4 .4 


Software  Description 


The  FTEPS  software  includes  software  of  the  avionics  simulator,  the  PSP, 
backup  PSP,  four  ELMCs,  four  GCUs,  and  four  RTs.  The  software  development 
procedure,  the  software  system  configuration  (Ref.  4),  as  well  as  the 
individual  processor  software  have  been  identified  during  the  preliminary 
design  of  the  FTE’S  program  phase  II. 

4.4.1  Development  Procedure 

The  development  procedure  (plan)  of  the  FTEPS  software  is  shown  in  Figure 
4.4-1.  This  development  plan  follows  a  structured  software  development 
methodology  based  on  the  Yourdon's  structured  programming  technique.  This 
development  methodology  is  divided  into  two  primary  phases,  Structured 
Analysis  (SA)  and  Structured  Design  (SD). 

The  SA  (Ref.  5)  is  a  tool  to  partition  requirements  and  specification  of  a 
given  system;  it  consists  of  three  types  of  documentation  tools,  Data  Flow 
Diagrams  (DFDs),  a  Data  Dictionary  (DD),  and  Structured  English.  The  DFDs 
portray  the  hierarchical  structure  of  the  system  in  terms  of  its  subsystems  or 
component  pieces,  and  show  flows  of  data,  not  control;  they  replace  the  use  of 
flow  charts  and  provide  improvement  in  terms  of  flexibility  for  modification 
and  well  defined  data  interfaces.  Figure  4.4-2  illustrates  the  concept  of  the 
leveled  DFDs.  The  DFDs  can  be  identified  as  the  top  level  (Context)  diagram, 
parent  diagrams,  child  diagrams  and  lastly  the  bottom  level  (Primitive) 
diagrams;  these  are  represented  by  numbered  bubbles  or  "processes".  External 
interfaces  are  called  terminators  or  source/sink;  these  are  represented  by 
boxes.  Information  or  control  command  flows  are  called  data-flows;  these  are 
represented  by  vectors  with  names  associated  to  the  data-flows.  The  SA  also 
provides  some  means  of  keeping  track  of  and  evaluating  interfaces;  this  is 
accomplished  by  defining  data  interfaces  among  the  software  and  the  system 
component  pieces  and  keeping  them  in  the  DD.  The  DD  supports  sets  of  DFD:>;  it 
is  a  repository  of  data  about  data  and  it  includes  the  set  of  procedures  used 
to  build  and  maintain  the  repository.  The  SA  is  also  a  tool  to  describe  logic 
and  policy  of  the  system's  control  and  display  processes;  this  is  accomplished 
by  the  Structured  English,  Decision  Tables  and  Decision  Trees.  The  Structured 
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English  is  a  replacement  of  narrative  text  specification  for  the  functions  or 
processes  within  the  overall  system,  and  it  may  use  Decision  Tables  or 
Decision  Trees  to  state  the  control  and  policy  of  the  system  functions. 

The  SD  (Ref.  6)  is  a  design  strategy  for  producing  a  highly  maintainable, 
easily  tested  top-down  design.  A  design  strategy  is  a  set  of  methods  for 
deriving,  evaluating,  refining  and  documenting  a  design.  A  top-down  design  is 
made  up  of  a  hierarchy  of  modules  each  one  a  single-entry,  single-exit 
subroutine  or  the  equivalent.  The  SD  supports  Transform  Analysis  and 
Transaction  Analysis  as  its  derivative  technique;  these  analyses  provide  means 
of  transition  from  SA  to  SD.  During  the  SD  phase,  control  flows  of  the 
functions  are  defined;  the  SD's  evaluative  and  refinement  techniques  include 
definitions  of  Coupling,  Cohesion,  Packaging  and  some  design  heuristics.  The 
final  product  of  the  SD  are  Structured  Charts  and  Pseudo  Codes;  these  are  used 
as  documentation  tools  of  the  design  phase. 

The  FTEPS  software  shall  use  Ada  High  Order  Language  ( HOL )  as  its  programming 
language.  Ada  is  a  registered  trademark  of  the  United  States  Government, 
Department  of  Defense  ( DOD ) ,  under  Secretary  for  Research  and  Engineering.  It 
is  a  highly  structured  language  consisting  of  all  five  basic  Constructs.  It 
is  a  modern  algorithmic  language  with  the  ability  to  define  types  and 
subprograms.  It  also  serves  the  need  for  modularity,  whereby  data,  types  and 
subprograms  can  be  packaged;  it  covers  real-time  programming,  with  facilities 
to  model  parallel  tasks  and  to  handle  exceptions.  Finally  both 
application-level  and  machine-level  input-output  (I/O)  are  defined,  thus  the 
need  for  programs  written  in  assembly  language  serving  the  I/O  functions  may 
he  eliminated.  A  validated  Ada  compiler,  targeted  for  1750A  and  hosted  on 
VAX/VMS,  along  with  a  Minimum  Ada  Program  Support  Environment  (MAPSE)  shall  be 
acquired  prior  to  actual  coding. 

Software  debug/emulation  shall  be  done  using  a  Tektronix  development  system 
followed  by  software/hardware  integration.  The  FTEPS  software  shall  be  tested 
during  the  verification  testing  to  assure  software  integrity  and  quality.  The 
verification  testing  shall  include  Preliminary  Qualification  Testing  (PQT)  and 
Formal  Qualification  Testing  (FQT).  The  qualification  requirement  satisfied 
by  the  PQT  is  the  verification  of  the  FTEPS  functional  or  application 
software.  This  will  be  accomplished  in  four  defined  levels: 
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Unit  Design  Testing  (Level  0) 

Module  Design  Testing  (Level  1} 

System  Design  Testing  (Level  2) 

Hardware  Design  Testing  (Level  3) 

The  qualification  requirement  satisfied  by  the  FQT  is  the  verification  of  the 
FTEPS  functional  or  applications  software  in  a  realistic  environment.  Tnis  is 
accomplished  by  generation  of  test  cases  for  each  component  of  the 
hierarchical  control  structure.  This  structured  methodology  ensures  clear, 
well-defined,  high-quality  software.  The  overall  software  structure  and 
interaction  of  the  modules  is  maintained  on  structured  charts;  this  provides 
stringent  configuration  management.  Reviews  will  be  held  to  "walk-through" 
ttie  DFD,  DD,  Structured  Charts,  and  the  Structured  English  to  enforce 
hiqh-quality  software. 

4.4.2  System  Configuration 

The  FTEPS  control  system  consists  of  a  distributed  computer  network.  The 
network  shown  in  Figure  4. 1.2-1,  consists  of  the  main  PSP,  a  backup  PSP,  an 
avionics  simulator  processor,  four  ELMC  processors,  four  RT  processors,  four 
GCUs  and  a  control  console.  This  computer  network  interfaces  the  FTEPS 
components;  these  components  include  backup  PSP,  SSPCs,  GCBs,  GCUs,  BTBs, 
power  buses,  Electrical  System  Control  Panel  (ESCP),  External  Power  Contactors 
(EPCs),  diodes,  transfer  relays,  EMPCs  and  control  console.  Information  or 
control  command  flows  are  illustrated  by  means  of  vectors  with  associated  name 
adjacent  to  the  vectors.  The  overall  FTEPS  software  network  representation  is 
shown  in  Figure  4.4-3;  this  diagram  is  the  Context  Diagram  of  the  FTEPS 
software  configuration.  The  Context  Diagram  is  the  top  level  diagram  of  the 
entire  set  of  DFDs;  it  portrays  the  system  configuration  in  terms  of  software 
and  its  hardware  interfaces  and  serves  as  a  formal  declaration  of  the  domain 
of  study. 

A  more  detailed  breakdown  of  the  FTEPS  software  is  illustrated  in  Figure 
4.4-4.  The  FTEPS  software  consists  of  four  major  types  of  processors 
including  the  avionics  simulator  processor,  PSPs,  ELMC  processors,  and  RT 
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F igure  4. 4-3.  Context  Diagram 


Figure  4.4-4.  DFDO.  The  FTEPS  Software 
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processors.  The  distributed  network  is  interconnected  via  a  dual  reoundant 
MIL-STD-1553B  multiplex  data  bus,  with  exception  of  the  link  with  the  avionics 
simulator  via  high  speed  data  bus  (RS-422).  The  four  primary  processes  of  the 
system  are  labeled  as  shown  below: 

1)  Simulate  Avionics  Functions 

2)  Perform  PSP  Control 

3)  Perform  ELMC  Control 

4)  Perform  RT  Control 


Out  of  all  the  externals/terminators  defined  in  the  Context  Diagram,  the 
process  Simulate  Avionics  Functions  interfaces  with  the  control  console 
through  data-flows,  power-system-status  and  power-system-requests;  it  also 
interfaces  with  the  process  Perform  PSP  Control  through  data-flows, 
RS-422-PSP-status,  and  RS-422-PSP-control-data.  The  names  of  the  data-flows 
are  descriptive  and  indicative,  thus  the  designer  can  readily  reconfigure  the 
design  throughout  the  design  phase.  Details  of  each  individual  data-flow  can 


be  found  in  the  DD. 

The  main  PSP  is  designated  as  the  bus  controller  of  the  FTEPS  MIL-STD-1 553B 
data  bus  .  It  interfaces  with  the  backup  PSP  via  two  discrete  I/O  lines  and 
uses  this  scheme  for  bus  control  transfer,  and  interfaces  with  the  rest  of  the 
system  processors  via  the  FTEPS  data  bus,  with  exception  of  communication 
between  itself  and  the  avionics  simulator  via  a  high  speed  data  bus.  It 
directs  the  performance  of  the  ELMCs  and  RTs,  which  are  MIL-STD-1553B 
terminals,  through  data  bus  messages;  all  the  FTEPS  data  bus  messages  conform 
to  the  MIL-STD-1 S53B  protocols. 

The  ELMC  processors  are  responsible  for  monitoring  their  local  EPS  components 
including  power  buses,  diodes,  SSPCs  and  transfer  relays  through  hardwired 
discretes.  In  addition  to  these  local  components,  it  also  interfaces  with  the 
ESCP  and  the  mai n  PSP . 

The  RT  processors  are  responsible  for  monitoring  their  local  EPS  components 
including  power  buses,  diodes,  and  EMPCs  through  hardwired  discretes.  In 
addition  to  these  local  components,  they  also  interface  with  the  ESIP  and  the 
main  PSP.  Out  of  the  four  RTs,  only  RT  #2  monitors  the  EPCs,  BTBs,  GCBs  and 
sends  external -power-ready  signal  to  the  GCU. 
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A  DD  for  the  preliminary  SA  is  shown  in  Figure  4.4-5;  it  includes  all 
data-flows  identified  during  the  preliminary  design  phase  for  the  four  major 
pieces  of  FTEPS  software. 


4.4.3  Avionics  Simulator 

The  FTEPS  avionics  bimulator  is  a  stand  alone  DEC  MicroVax  II  microcomputer 
with  a  monochrome  VT220  terminal  for  the  operator  control  console  and  a  color 
graphic  VT240  monitor  for  the  display  console.  It  has  hardware  interfaces 
with  the  PSPs  via  high  speed  data  buses  (RS-422)  for  data  transfer,  and 
discrete  I/O  interfaces  with  the  PSPs  for  selection  of  the  main  PSP. 

The  avionics  simulator  software  resides  in  the  avionics  simulator  that  is  a 
part  of  the  distributed  computer  network  designed  to  perform  EPC  control  for 
the  FTEPS.  The  avionics  simulator  software  provides  in  a  laboratory 
environment,  those  functions  of  the  avionics  simulator  that  are  essential  for 
successful  operation  and  testing  of  the  FTEPS  control.  Functions  performed  by 
this  software  are  depicted  in  Figure  4.4-6,  DFD1  of  the  process  Simulate 
Avionics  Functions.  These  functions  include: 

o  Receive  and  Process  Operator  Inputs 
o  Receive  Electrical  System  Configuration  Data 

o  Initiate  System  Startup/Shutdown 

o  Update  the  Electrical  System  Components'  status 
o  Display  the  System  Configuration 

o  Transmit  Control  Requests  to  the  PSP 

The  process,  Simulate  Avionics  Functions,  has  software  interfaces  with  the 
control  console  through  data-flows,  power-system-status  and 
power-system-requests;  it  also  interfaces  with  the  process  Perform  PSP  Control 
through  data-flows,  RS-422-PSP-status ,  and  RS-422-PSP-control -data .  Details 
of  all  data-flows  and  subprocesses  of  the  process  Simulate  Avionics  Functions 
involved  is  shown  in  Figure  4.4-6,  DFD1.  A  list  of  local  definitions  for  the 
DFD1  is  shown  in  Figure  4.4-7;  this  list  includes  a  subset  of  the  DD  directly 
related  to  this  process,  and  local  diagrams'  internal  data-flows.  A  complete 
definition  list  shall  be  derived  during  the  detail  design  phase. 
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A-ELWC-ac-TR-pos i t i on  -  ‘Actual  command  of  AC  transfer  relay* 


A-ELHC-dc-TR-position  -  ‘Actual  command  of  DC  transfer  relay* 


A-ELHCl-SSPC-coaaands  •  ‘Actual  SSPC  on/off  cosaand* 


A-ELHC2-SSPC-coaaands  -  ‘Actual  SSPC  on/off  cosusands* 


A-ELMC3-SSPC-coaaands  -  ‘Actual  SSPC  on/off  cosusands* 


A-ELHC4-SSPC-coaaands  -  ‘Actual  SSPC  on/off  commands* 


A-ac-EHPC-on/of f  -  ‘Actual  AC  type  EHPC  on/off  command* 


A-dc-EHPC-on/of f  -  ‘Actual  DC  type  EHPC  on/off  command* 


ANALOG-VOLTAGE 

B-DP-fault-inhibit  -  ‘Commmand  data  from  the  PSP* 

BOOLEAN 

B-ELHC-control-data  •  1{  B-Priority-level 

*  B-ac-TR-comaand 

*  B-dc-TR-coaaand 

*  B-SSPC-power-request 

*  1 (B-SSPC-power-request } 100 

*  (B-DP-fault-inhibit) 

M 

B-ELHC- status  -  *ELHC  status  to  the  PSP  via  the  1553B  bus* 

1{  (  B-ac-TR-position 

*  B-dc-TR-position 

*  B-ELHC-ac-vol tage 

*  B-ELHC-dc- voltage 

*  B-ELHC-battery-voltage 

*  1 (B-ELHC-di ode-status) 2 

|  1 (B-SSPC-t rip-bit ) 100 

*  1 (B-SSPC-on/of f-bit) 100 

1 

M 

B-GCU-status  -  ‘Generator  information;  transmitted  directly* 
‘from  the  GCUs  to  the  PSP  via  1553B  data  bus* 
1(  B-Generator-on/of f 

♦  B-BTB-open/close 

♦  B-GCB-on/of  f 

♦  B-Gene rator-cur rent 

♦  B-Oil-temperature 
)4 

B-Priority-level  -  *16  levels;  from  PSP* 


B-RT41-status  -  (  1 { B-ac-EHPC-on/of f -status } 1 0 


Figure  4.4-5.  Data  Dictionary 
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m  *  *  m  rn  kSB  AJI  fj 


B-RT#2-status 


B-RT#  3-status 


+  1  (B-ac-EMPC-trip-status)  10 

+  1 (B-dc-EMPC-on/of f-status)  18 

+  1  { B-dc-EMPC- 1 r ip-status )  18 

|  B-ac-bus#l-voltagex 
+  B-dc-bus#l-voltage 
+  B-TRU-#l-status 

1 

(  1 { B-ac-EMPC-on/of f- s ta tus )  1 2 

+  1  ( B-ac-EMPC- 1 r i p- status ) 12 

+  1 { B-dc-EMPC-on/of f-status )  1 7 

+  1  ( B-dc-EMPC- 1 r i p- status )  17 

|  B-ac-bus2-voltage 
+  B-dc-bus2-vol tage 
+  B-batt“ry-bu6l-voltage 
+  B-TRU-#2-status 
+  B-batte ry-busl-SOC 
+  B-main-diodel-status 
+  1  ( B-EPC-status ) 

] 

[  1 ( B-ac-EMPC-on/of f-status )  1 2 

+  1 { B-ac-EMPC- 1 r ip-status )  12 

+  1 ( B-dc-EMFC-on/of f-status )  17 

♦  1 ( B-dc-EMPc- t r ip-status } 17 

|  B-ac-bus3-vol tage 
+  B-dc-bus3-voltage 
+  B-batte ry-bus2-vol tage 
+  B-batte ry-bus2-SOC 
+  B-TRU-# 3-status 
+  B-main-bus-diode2-status 


B-RT#  4-status 


[  1 ( B-ac-EMPC-on/of f-status )  10 

+  1 { B-ac-EMPC- t r i p-sta tus ) 10 

+  1 ( B-dc-EMPC-on/of f-status  J 18 

+  1  { B-dc-EMPC- 1 r ip-status )  18 

|  B-ac-bus4-vol tage 
+  B-dc-bus4-voltage 
+  B-TRU-# 4 -status 

] 


B-RT-control-data  -  *RT  control  data  PSP  -->  RT  via  the  1553B 

1(  B-Pr  iority-level 
+  1  (  B-ac-EMPC-on/of  f-co*«!and }  12 

+  1  (  B-dc-EMPC-on/of f-co*«andj 18 

)4 


*  For 

* 

RT 

#1  & 

#4, 

ac-EMPC-coauoands :  -1 0* 
dc-EMPC- commands : -18* 

*For 

* 

RT 

#2  & 

#3, 

ac-EMPC-commands : -12* 
dc-EMPC- commands :  -17* 

B-RT-status  - 


*RT  status;  RT--PSP  via  the  1  5 5 3B  bus* 

B-RT#l-status 

B-RT#  2-status 

B-RT#  3-status 

B-RT#4-  status 


B-ac-EMPC-on/of f-comoand  -  *AC  EMPC's  power  request  bit* 

*from  the  PSP* 

BOOLEAN 

B-dc-EMPC-on/of f-com*and  -  *DC  EMPC's  power  request  bit* 

‘from  the  PSP* 

BOOLEAN 


Figure  4.4-5.  Data  Dictionary  (Continued) 


BASE-CONFIGURATION  -  * P r e-de t e rmi ned  conif iguration  data  fot 

*  cold  start  condition  * 

*0R  the  previous  system  configuration  * 

*  before  the  warm  start  * 

*  condition  requested  * 

BTB-status  -  ‘Bus  Tie  Breaker  hardwired  status  line  to  the  RTs * 
*BTBs  — >  RTS* 

R-BTB-1 -po  sit  ion 
+  R-BTB-2-posi tion 
+  R-BTB-3-position 
+  R-BTB-4-position 

COMMAND-FLAG-FILE  -  AS-command- f 1 ag s 

+  data-bus-f lag 

ELMC-CONTROL-DATA  -  ‘Data  from  the  1553B  data  bus--sent  by  the  PSP* 

1{  ac-TR-command-f lag 
+  dc-TR-coamand-f lag 
+  priority-level-word 
+  1 { SSPC-power-request-bi t } 100 

M 

ELMC-STATUS-DATA  -  1 ( SSPC-status-data } 100 

+  ELMC-Voltage-data 
+  Transfer-relay-status-data 

EMPC-commands  -  ‘Actual  commands  from  the  RTs  to  the  EMPCs* 

1 { A-ac-EMPC-on/of  f  }  40 
+  1 ( A-dc-EMPC- on/of  f } 40 

EMPC-powe r- request-bi t  -  ‘Binary  bit;  may  be  from  a  matrix* 

BOOLEAN 

EMPC-status  -  * EMPC  raw  data  for  the  RTs* 

R-RTil-EMPC-s  ta  tus 
+  R-RT#2-EMPC-status 
+  R-RT#  3-EMPC-status 
+  R-RT# 4-EMPC- Status 

EMPC-status-data  -  1 ( EMPC-tr ip-status ) 50 

+  l(EMPC-on/off-status}50 

EMPC-tr ip-status  -  “ 

EPC-command-status  -  ‘External  Power  Contactors'  command  status* 

*EPCs  raw  data  — >  RT  #2* 

R-EPC-1 -command-status 
+  R-EPC-2-command-status 
♦  R-External-power-quality 

EPC-6tatus-data  -  ‘Internal  to  the  RT  software* 

EPC-l-on/of  f 
♦  EPC-2-on/of  f 

External-power-ready  -  ‘Discrete  hardwired  to  the  GCU* 

BOOLEAN 

GCB-statu6  -  ‘Generator  Control  Breakers'  status  positions* 
‘Directly  wired  raw  data  of  GCBs  to  the  RTs* 

R-GCB-*1 -position 
+  R-GCB-#2-position 
+  R-GCB-*3-position 
+  R-GCB-#4-position 


Figure  4.4-5.  Data  Dictionary  (Continued) 
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Ma i n- Vol t age -da ta  -  ‘Internal  to  the  ELMC  software* 

l{main-ac-bus-voltage)4 
+  1 {main-dc-bus-voltage ) 4 

+  1 { main-ba tte ry-vol f age ) 2 

+  1 ( main-ba tte ry-SOC } 2 

+  1 {main-bus-TRU-status ) 4 

+  1 { main-bus-diode-status ) 4 

NEW- CON FIGURATION  -  cur rent-conf g 

+  confg-changes 

R-ELMC-ac-bus-vol tage  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 

R-ELMC-battery-voltage  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 

R-ELMC-bus-diode-status  -  *TBD  in  the  detail  design  phas 

R-ELMC-dc-bus-vol tage  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 

R-ELMC-power-bus-status  -  1 ( R-ELMC-ac-bus-vol tage } 4 

+  1  {  R-ELMC-dc-bus-vol tage } 4 

+  1  {  R-ELMC-battery-voltage ) 4 


R-EPC-l-command-status  -  ‘Hardwired  status  bit  to  RT  |2* 

R-EPC-2-command-status  -  ‘Hardwired  status  bit  to  RT  #2* 

R-ma i n-ac-bus-voltage  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 

R-main-battery-SOC  -  ‘Percentage  of  battery  charge* 

REAL 

R-main-battery-voltage  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 

R-main-bus-TRU-status  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 

R-mai n-bus-diode-status  -  *TBD  in  the  detail  design  phase 


R-main-dc-bus-voltage  -  ‘Actual  analog  voltage  level* 

‘From  the  voltage  sensor* 
ANALOG-VOLTAGE 

R-main-power-bus-status  -  1  {  R-ma in-ac-bus-vol tage } 4 

+  1  {  R-ma i n-dc-bus-vol tage ) 4 

+  1  {  R-main-battery-voltage ) 2 

♦  1  {  R-mai n-battery-SOC ) 2 

+  1  {  R-ma i n-bus-TRU-status ) 4 

RS232-EF  -control-request  -  ‘Avionics  Simulator  •«>  PSP 
RS232-SS  control-request  -  ‘Avionics  Simulator  -->  PSP 
RS232-disp  ay-selection  -  ‘Avionics  Simulator  -->  PSP* 


Figure  4.4-5.  Data  Dictionary  (Continued) 


RS,2  3 2  -  f  1  i  gh t/mi  6s  i  on-pha se  -  ‘Avionics  Simulator  -->  PSP* 

RS232-load-control-request  -  ‘Avionic  Simulator  -->  PSP* 

RS232-startup/8hutdown-request  -  ‘Avionics  Simulator  -->  PSP* 

RS422-PSP-eontrol-data  -  1 { RS422-SSPC-control-requests} 400 

+  1 { RS4  22-EMPC-cont  rol- requests  j 112 

+  1 (RS4 22- load-control- requests) 300 

+  RS422-flight/mission-phase 
+  RS422-sta rtup/shutdown-f lags 

RS422-PSP-st atus  -  ‘Display  and  Configuration  information  of  the  EPS* 

*PSP  -->  Avionics  Simulator* 

RT-CONTROL-DATA  -  1 ( EMPC-powe r - r eque s t-bi t } 5 0 

RT-STATUS-DATA  -  EMPC-Status-data 
-f  Main-Voltage-data 
+  EPC-statu6-data 

SSPC-commands  -  ‘Actual  commands  from  the  ELMCs  to  individual  SSPCs* 
A-ELMC1-SS PC- commands 
+  A-ELMC2-SSPC-commands 
+  A-ELMC3-SSPC-commands 
+  A-ELMC4-SSPC-commands 

SSPC-power-request-bit  -  ‘Local  ELMC  processor  data  flow* 

SSPC-status  -  ‘Raw  status  data  from  the  SSPCs  to  the  ELMCs* 

‘SSPCs  — >  ELMCs  -->  PSP* 

R-ELMC1 -SSPC-status 
+  R-ELMC2-SSPC-Status 
+  R-ELMC 3 -SSPC-status 
+  R-ELMC4-S3PC-Status 

backup-on  -  ‘Discrete  I/O;  hi/lo  indicator* 

diode-status  -  *Raw  data  of  diodes  to  either  RTs  or  ELMCs* 

‘Diodes  -->  [ELMCs  |  RTs)  -->  PSP* 

R-main-bu6-di ode- status 
+  R-ELMC-bus-diode-status 

initialization-data  -  ‘Flags  for  initialization* 
main-on  -  ‘Discret**  I/O,  hi/lo  indicator* 

manual-pr iority-6elect  -  ‘Manual  switch  from  the  Electricl  System* 

•Control  Pannel  for  either  ELMCs  or  RTs* 
RAW-MANUAL- PRORITY-SELECT 

monitor-data  -  *Two  hardwired  discretes  for  bus  control  transfer* 

*Raw  data  — >  PSPs;  no  1553B  message  transfer  directly* 
main-on 
+  backup-on 

new-conf ig-data  -  *FTEPS  components  changes* 


Figure  4.4-5.  Data  Dictionary  (Continued) 


power-bu6-st atus  -  ‘Power  bus  voltages  rating  to  either  RTs  of  ELMCs* 

•Voltages  — >  [ELMCs  |  RTs]  -->  PSP* 

R-ma in-power-bus- status 
+  R-ELMC-power-bus-status 


powe r-system- requests  - 


+ 

+ 

+ 

+ 

+ 


•Operator  requests  via  the  Avionics  Simulator* 
•RS232  data  -->  Avionics  Simulator;  AS  -->  PSP* 
RS2 32-flight/mission-phase 
RS 2  32-star  tup/shutdown- request 
l{RS232-load-control-request)300 
1 { RS2 3 2-SSPC- control- request] 400 
1 ( RS232-EMPC-control- request) 112 
RS232-display-se lection 


power-system-status  - 


+ 

+ 

+ 

+ 

+ 

+ 

+ 


•Display  data  from  the  Avionics  Simulator* 

•to  Control  Console  via  a  RS232  data  bus* 

RS232-TR-positions 

RS 2 3 2-SSPC- status 

RS232-ELMC-status 

RS232-Power-bus-vol tages 

RS2 3 2-Diode -status 

RS232-EMPC-status 

RS232-TRU-status 

RS232-EPC-status 


transfer-relay-commands  -  *Actual  commands  for  Transfer  relays* 

*PSP  -->  ELMCs  -->  Transfer  relays* 

1 (A-ELMC-ac-TR-position) 4 
+  1 (A-ELMC-dc-TR-positionj 4 


transfer-relay- status 


«  *Raw  data  of  Transfer 

R-ELMC-1- relays 
+  R-ELMC-2-relays 
+  R-ELMC-3-relays 
+  R-ELMC-4-relays 


relays  to  the  ELMCs* 


Figure  4.4-5.  Data  Dictionary  ( Continued ) 
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RS  422- 
PSP- STATUS 


1  ELECTRICAL 
l  SYSTEM  i 
VCONFlGURATtON/ 


RS232 

STARTUP/ 

SHUTDOWN- 

REQUESTS 


r  NEW- 
CONFIG- 
OATA 


1  1 

INITIATE 

SYSTEM 

STARTUP/ 

SHUTDOWN 


INITIAL 

I2ATION- 

DATA 


f  >3  > 

UPDATE 
ELECTRICAL 
SYSTEM 
COMPONENTS' 
\  STATUS  y 


RS  232- 
DISPLAY- 
SELECTION 


STATUS  FILE 


I  14  l 

DISPLAY  SYSTEM 
\CONFIGURAlTON) 


1.5 

HANDLE 

CONTROL 

REQUESTS 


rPOWER- 

SYSTEM- 

STATUS 


(RS  232- 
LOAQ- 
CONTROL- 
REQUEST 


RS  4  22- 
PSP- 

rcONTROl 

DATA 


RS232 

FLIGHT/ 

MISSION- 

PHASE 


RS  232- 
SSPC- 
CONTROL- 
REOUESTS 

\  RS  232- 
\  EMPC- 
CONTROL- 
|  REQUESTS 


Figure  4.4-6.  DFD1.  Simulate  Avionics  Functions 


powe r -sy s t pm  tequests  - 


+ 

+ 

+ 

+ 

+ 


•Operator  requests  via  the  Avionics  Simulatoi * 
•RS232  data  -«>  Avionics  Simulator;  AS  PSP 

RS232-flight /mission- phase 
RS2 32-startup/ shutdown- request 
l(RS232-load-control-request)300 
l{RS232-SSPC-control-request)400 
l{RS232-EMPC-control-request)112 
RS2 32-display-select  ion 


power-system-status  - 


+ 

+ 

+ 

+ 

+ 

+ 

+ 


•Display  data  from  the  Avionics  Simulator* 

•to  Control  Console  via  a  RS232  data  bus* 

RS2  32-TR-posi t ions 

RS232-SSPC-status 

RS232-ELMC -status 

RS2 32-Power- bus-volt ages 

RS232-Diode-status 

RS232-EMPC-status 

RS232-TRU-status 

RS232-EPC-status 


RS232-f 1 ight/mission-phase  -  ‘Avionics  Simulator  -->  PSP* 


RS232-startup/shutdown-request  -  ‘Avionics  Simulator  -->  PSP* 


RS2  32- load-cont rol - request  - 
RS232-SSPC-cont rol- request  - 
RS232-EMPC-control-request  « 


•Avionic  Simulator  -->  PSP* 
•Avionics  Simulator  -«>  PSP* 
•Avionics  Simulator  *->  PSP* 


RS232-display-selection  -  ‘Avionics  Simulator  =«>  PSP* 


RS422-PSP-cont rol-data  - 

+ 

+ 

+ 

+ 


1 { RS422-SSPC-cont rol -requests) 400 
1 ( RS422-EMPC-cont rol- requests} 112 
1 { RS422-load~cont  rol- requests ) 300 
RS422-fl ight/mi ss ion- phase 
RS 4  22-star tup/shutdown- flags 


RS422-PSP-status  -  ‘Display  and  Configuration  information  of  the  EPS* 

*PSP  -->  Avionics  Simulator* 

new-conf ig-data  -  *FTEPS  components  changes* 
initialization-data  -  ‘Flags  for  initialization* 

Figure  4.4  7.  Definition(s)  in  DFD:  1 
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4.4.3. 1  Initiate  System  Startup/Shutdown 


This  process  of  the  avionics  simulator  software  is  designed  to  receive 
operator  inputs,  via  the  data-flow  power-system-requests,  indicating  the 
initialization  condition.  These  inputs  reflect  either  a  cold  start,  a  warm 
start  or  a  shutdown  request.  A  cold  start  indicates  a  request  for  power  up 
configuration,  whereas  a  warm  start  indicates  a  request  for  the  previously 
stored  system  configuration.  The  shutdown  request  along  with  the  startup 
request  is  sent  to  the  PSP  for  initialization  or  termination  of  the  FTEPS 
control.  This  initialization  information  is  locally  stored  and  passed  to 
other  avionics  simulator  processes. 

4. 4. 3. 2  Accept  Electrical  System  Configuration 

This  process  of  the  avionics  simulator  software  receives  the  EPS  configuration 
status  from  the  PSP,  through  the  data-flow  RS-422-PSP-status,  synchronously. 
The  EPS  configuration  status  includes  fault  status  and  configuration  changes 
of  the  following: 

o  SSPC  status 

o  EMPC  status 

o  6CU  status 

o  Load  profile 

o  Generator  status 
o  ELMC  status 

o  TRU  status 

o  Bus  Voltages 

o  Diode  status 

This  information  is  passed  as  packaged  parameters,  new-conf ig-data,  to  the 
process  Update  Electrical  System  Components'  Status. 

4. 4. 3. 3  Update  Electrical  System  Components'  Status 

This  process  of  the  avionics  simulator  updates  the  EPS  configuration  status 
files  by  processing  new-conf ig-data  and  initialization-data.  If  the  system  is 
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under  cold  start  or  the  first  time  through  after  power  up,  then  a  prestored 
cold  start  configuration  is  retrieved  and  used  as  current  system 
configuration.  With  the  current  system  configuration  data  and  new  system 
configuration  data,  this  process  updates  and  compares  these  two  sets  of 
configuration  data,  records  changes  and  stores  the  most  recent  system 
configuration  data  in  the  status  file. 

4. 4. 3. 4  Display  System  Configuration 

This  process  of  the  avionics  simulator  receives  display  requests  from  the 
operator  and  displays  system  information  as  requested.  The  display  modes  are 
grouped  as  normal  display  mode,  maintenance  display  mode,  and  system  self 
check  display  mode.  The  normal  display  mode  displays  the  current  level  of  the 
generators,  voltage  level  of  the  power  buses  and  TRUs,  state  of  charge  of  the 
batteries,  transfer  relay  positions  of  the  ELMCs,  and  fault  status  of  the 
following  components: 

o  Generators 

o  Power  Buses  (Main  AC,  DC,  Batteries;  ELMC  AC,  DC,  Batteries) 
o  Batteries 
o  ELMCs 
o  SSPCs 

The  maintenance  display  mode  displays  all  faults  and  auto  resets  of  the 
FTEPS.  Failures  are  indicated  as  overcurrent,  Differential  Protection  (DP) 
fault,  battery  failure,  and  etc.  The  system  self  check  display  mode  displays 
the  system  information  under  the  initialization  and  startup  condition;  this 
display  is  similar  to  the  normal  mode  display.  All  system  displays  are 
designed  in  graphic  representation  with  faults  highlighted. 
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4.4.3.')  Handle  Control  Requests 

This  process  of  the  avionics  simulator  receives  power  system  requests  from  the 
system  operator;  these  requests  include  the  following: 

o  Flight/Mission  Phase 
o  Load  Control  Requests 

o  EMPC  Control  Requests 

o  SSPC  Control  Requests 

These  control  requests  and  the  system  startup/shutdown  flags  are  packaged  and 

sent  to  the  main  PSP  through  data-flow  RS-422-PSP-control-data. 

4.4.4  Power  System  Processor 

The  FTEPS's  PSP  is  a  MI L-STD-1 750A  microcomputer  system.  It  has  hardware 
interfaces  with  the  backup  PSP  through  two  hardwired  discrete  I/O  to  provide 
redundant  bus  control  and  interfaces  with  the  dual  redundant  MI L-STD-1 553B 
multiplex  data  buses . 

The  PSP  software  resides  in  the  PSP  is  a  part  of  the  distributed  computer 
network  designed  to  manage  and  control  the  FTEPS,  and  directs  the  data  bus. 

The  PSP  provides  in  a  laboratory  environment,  those  functions  of  the  PSP  that 
are  essential  for  successful  operation  and  testing  of  the  FTEPS  control. 
Functions  performed  by  this  software  are  depicted  in  Figure  4.4-8,  DFD2  of  the 
process  Perform  PSP  Control.  These  functions  include  the  following: 


System  Control  Commands  Handling 

Electrical  System  Configuration  Status  Handling 

Data  Bus  Control 


System  Initialization 
Monitor  Electrical  System 

Schedule  the  Electrical  System  Processor  Requests 
Schedule  the  Electrical  System  Requests 
Process  the  Electrical  System  Requests 
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Figure  4.4-8.  DFD2.  Perform  PSP  Control 


The  process,  Perform  PSP  Control,  has  software  interfaces  with  the  avionics 
simulator  through  data-flows,  RS-422-PSP-control-data  and  RS-422-PSP-status . 

It  also  interfaces  with  the  MIL-STO- 1 553B  bus  interface  units,  backup  PSP, 

RTs,  ELMCs  and  GCUs.  Details  of  all  data-flows  and  subprocesses  of  this 
software  are  shown  in  Figure  4.4-8,  DFD2.  A  list  of  local  definitions  for  the 
DFD2  is  shown  in  Figure  4.4-9;  this  list  includes  a  subset  of  the  DD  directly 
related  to  this  process,  and  local  diagrams'  internal  data-flows. 

4.4.4. 1  Handle  System  Control  Commands 

This  process  of  the  PSP  software  is  designed  to  receive  system  control 
requests  from  the  avionics  simulator  via  a  RS-422  high  speed  data  bus.  These 
requests  include  the  following: 

o  Flight/Mission  Phase 

o  Load  Control  Requests 

o  EMPC  Control  Requests 

o  SSPC  Control  Requests 

o  Startup/Shutdown  Flags 

These  requests  are  processed  and  packaged  into  a  data-flow  AS-command-f lags, 
and  stored  in  the  local  repository  file,  COMMAND-FLAGS. 

4. 4. 4. 2  Handle  Electrical  System  Configuration  Status 

This  process  of  the  PSP  software  is  designed  to  receive  the  FTEPS  subsystem 
components'  status  via  the  FTEPS's  data  bus.  Three  groups  of  status  are 
identified  under  data-flows,  B-ELMC-status,  B-GCU-status  and  B-RT-status. 
Details  of  each  of  the  MIL- STD- 1 553B  bus  data  messages  are  shown  in  Figure 
4.4-9;  these  messages  include  status  data  of  EPCs,  SSPCs,  voltage  levels,  and 
etc.  This  process  retrieves  the  data-bus-f lag  and  receives  bus  data  from  the 
designated  data  bus,  and  stores  the  information  in  the  file  BASE-CONFIGURATION 
or  NEW-CONFIGURATION. 
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monitor-data  -  ‘Two  hardwired  discretes  for  bus  control  transfer* 

*Raw  data  -->  PSPs;  no  1553B  message  transfer  directly* 
main-on 
+  backup-on 

B-GCU-status  -  ‘Generator  information;  transmitted  directly* 

*from  the  GCUs  to  the  PSP  via  1553b  data  bus* 

1(  B-Generator-on/of f 
+  B-BTB-open/close 
+  B-GCB-on/off 
+  B-Generator-current 
+  B-Oi 1-temperature 

M 

main-on  -  *Discrete  I/O,  hi/lo  indicator* 


backup-on  -  ‘Discrete  I/O;  hi/lo  indicator* 


RS422-PSP-control-data 


1 { RS 4 22-SSPC-cont rol- requests } 400 
1 ( RS4  22-EMPC-cont rol- requests } 112 
1 ( RS422-load-cont  rol -requests ) 300 
RS4 2 2- flight/mission-phase 
RS422-star  tup/shutdown- f lags 


RS422-PSP-status  -  ‘Display  and  Configuration  information  of  the  EPS* 

*PSP  -->  Avionics  Simulator* 


B-ELMC-cont  rol -data 


H 

+ 

+ 

+ 

+ 

+ 

H 


B-Priority-level 
B-ac-TR- command 
B-dc-TR- command 
B-SSPC-power- request 
1 (B-SSPC-power- request )  100 
(B-DP- fault- inhibit) 


B-ELMC-status  -  *ELMC  status  to  the  PSP  via  the  1553B  bus* 
1{  [  B-ac-TR-posi tion 
+  E-dc-TR-position 
+  B-ELMC-ac-voltage 
+  B-ELMC-dc-voltage 
+  B-ELMC-battery-voltage 
+  1 { B-ELMC-diode-s tatus } 2 

|  l{B-SSPC-trip-bit]100 
+  1 ( B-SSPC-on/of  f-bi t ) 100 


14 

B-RT-control-data  - 


* RT  control  data  PSP  -->  RT  via  the  1553B* 
1{  B-Pr io  r  i  ty-level 
+  1 ( B-ac-EMPC-on/of f-command) 12 

+  1  {  B-dc-EMPC-on/of f-commandj 18 

14 

‘For  RT  #1  &  14,  ac-EMPC-commands : -10* 

*  dc-EMPC-commands : -18* 

*  For  RT  #2  i  #3,  ac- EMPC-commands : -1 2  * 

*  dc-EMPC-commands :  —  1 7  * 


B-RT-status 


*RT  status;  RT--PSP  via  the  1553B  bus* 

B-RTtl-StatU6 

B-RT#2-statu6 


Figure  4.4-9.  Definition(s)  in  DFD:  2 
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+  B-RT#  3-status 
+  B-RTi 4-status 


COMMAND-FLAG-FILE  -  AS-command- f lags 

+  data-bus-f lag 

NEW-CONFIGURATI ON  -  cu r ren t-conf g 

+  conf g-changes 

BASE-CONFIGURATION  -  * P re-de te r mined  coni  figuration  data  for 

*  cold  start  condition 
*0R  the  previous  system  configuration 

*  before  the  warm  start 

*  condition  requested 

cur rent-confg  -  TBD 
AS-coramand-f lags  -  TBD 
data-bus-f lag  -  TBD 
start-conf  -  TBD 
conf g-changes  -  TBD 
RS422-SSPC-control-requests  -  TBD 
RS422-EMPC-control-requests  -  TBD 
RS422-load-control-requests  -  TBD 
RS422-f light/mission-phase  -  TBD 
RS422-startup/shutdown-f lags  -  TBD 


Figure  4.4-9.  Definition(s)  in  DFD:  2  (Continued) 


4. 4. 4. 3  Control  the  MIL-STD-1553B  Data  Bus 


This  process  of  the  PSP  software  assumes  the  control  the  FTEPS  data  bus;  it 
monitors  two  discrete  I/O  links  with  the  backup  PSP  and  chooses  an  active  data 
bus  from  the  dual  redundant  data  bus  architecture.  This  process  conforms  to 
the  standards  of  MI L-STD-1 553B  protocol. 

4. 4. 4. 4  Initialize  The  Electrical  Power  System 

This  process  of  the  PSP  software  retrieves  the  system  startup/shutdown  flags 
from  the  COMMAND-FLAGS  file  and  initializes  the  system  configuration  using 
data  stored  in  the  BASE-CONFIGURATION  file  according  to  these  flags.  If  the 
startup  flag  indicates  a  cold  start,  this  process  initializes  and  reconfigures 
the  EPS  according  to  the  previous  system  configuration  prior  to  the  last 
startup  event  set.  If  the  shutdown  flag  is  set,  this  process  sets  its 
internal  terminate  flag  and  exits. 

4. 4. 4. 5  Monitor  The  Electrical  System 

This  process  of  the  PSP  software  monitors  the  electrical  system  components' 
status  and  updates  the  system  status  by  comparing  the  previous  and  the  current 
configuration  data,  and  stores  the  conf ig-changes  in  the  NEW-CONFIGURATION 
file. 


4. 4. 4. 6  Schedule  Processor  Requests 

This  process  of  the  PSP  software  retrieves  configuration  data  from  the 
NEW-CONFIGURATION  file,  and  the  following  command  flags  from  the  COMMAND-FLAGS 
file: 

o  Shutdown  flag 

o  Mission/Flight  phase 

o  Load  change  flags 

o  EMPC  change  flags 

o  SSPC  change  flags 
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and  sets  appropriate  request  flags  to  schedule  the  system  control.  The 
request  flags  include  the  following: 

o  Load  Shedding  flag 

o  ELMC  Transfer  flag 

o  Load  Control  flag 

o  System  Termination  flag 

These  request  flags  are  stored  in  the  COMMAND-FLAGS  files  upon  completion  of 
the  process. 

4. 4. 4. 7  Process  The  Processor  Requests 

This  process  of  the  PSP  software  retrieves  the  processor  request  flags  from 
the  COMMAND-FLAGS  file  and  the  current  system  configuration  data  from  the 
NEW-CONFIGURATION  file.  It  processes  these  data  and  sends  out  control  data  to 
ELMCs  and  RTs;  it  also  transmits  the  electrical  system  configuration  along 
with  the  system  fault  status  to  the  avionics  simulator  via  the  data-flow, 
RS-422-PSP-status.  This  process  monitors  the  changes  of  the  processor 
requests  and  sends  priority  level  and  ELMC  transfer  relay  control  data  to 
ELMCs  every  minor  cycle;  it  sends  the  same  priority  level  to  RTs  every  minor 
cycle  as  well.  The  priority  level  reflects  the  current  operating  mode  of  the 
aircraft's  flight/mission  phase;  it  reflects  either  ELMC  transfer,  load 
control  or  load  shedding.  Load  control  of  the  EPS  is  accomplished  by 
implementing  boolean  expressions  with  a  combination  of  priority  level  and 
power  requests.  The  SSPC  power  requests  are  sent  to  ELMCs  via  the  data-flow 
B-ELMC-control-data,  and  the  EMPC  power  requests  are  sent  to  RTs  via  the 
data-flow  B-RT-control-data.  Upon  receiving  the  shutdown  flag  this  process 
terminates  and  ends  the  laboratory  simulation. 


4.4.5 


FLMC 


The  FTEPS's  ELMC  incorporates  a  MIL-STD-1 750A  microcomputer.  It  has  hardware 
interfaces  with  up  to  TOO  local  SSPCs,  ELMC  power  bus  voltage  sensors,  two 
diode  status  inputs,  two  transfer  relay  position  discrete  inputs  and  ESCP's 
manual  priority  select  switches.  In  addition,  the  ELMC  has  hardware 
interfaces  with  a  dual  redundant  MIL-STD-1553B  multiplex  data  bus.  The  ELMC 
is  considered  as  a  remote  terminal  of  the  MIL-STD-1553B  data  bus. 

The  ELMC  software  resides  in  the  ELMC  that  is  a  part  of  the  distributed 
computer  network  designed  to  manage  and  control  the  FTEPS.  The  ELMC  software 
provides  in  a  laboratory  environment,  those  functions  of  the  ELMC  that  are 
essential  for  successful  operation  and  testing  of  the  ELMC  local  control. 

These  functions  include  the  following: 

o  Handle  PSP  Control  Commands 

o  Monitor  ELMC  Power  Buses 

o  Monitor  SSPC  Status 

o  Control  SSPCs 

o  Control  ELMC  Transfer  Relays 

o  Transmit  ELMC  Status  Data 

o  Perform  ELMC  Emergency  Functions 

The  process,  Perform  ELMC  Functions,  has  software  interfaces  with  the  main  PSP 
through  data-flows,  B-ELMC-control-data  and  B-ELMC-status-data.  Details  of 
all  data-flows  and  subprocesses  of  this  software  are  shown  in  Figure  4.4-10, 
DFD3.  A  list  of  local  definitions  for  the  DFD3  is  shown  in  Figures  4.4-11. 
This  list  includes  a  subset  of  the  DD  directly  related  to  this  process,  and 
local  diagrams'  internal  data-flows. 

4.4.5. 1  Receive  MIL-STD-1 553B  Bus  Data 

This  process  of  the  ELMC  software  is  designed  to  receive  PSP  control  data 
through  data-flow,  B-ELMC-control-data,  via  the  MIL-STD-1 553B  data  bus.  The 
control  data  includes  the  following: 
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Figure  4.4-10.  DFD3.  Perform  ELMC  Functions 


SSPC-status 


-  ‘Raw  status  data  from  the  SSPCs  to  the  ELMCs* 

•SSPCs  -->  ELMCs  — >  PSP* 

R-ELMC1 -SSPC-status 
+  R-ELMC2-SSPC-Status 
+  R- ELMC3- SSPC- S  ta  tus 
+  K-ELMC4-SS PC -status 

SSPC-commands  -  ‘Actual  commands  from  the  ELMCs  to  individual  SSPCs 
A- ELMC1 -SSPC- commands 
+  A-ELMC2-SSPC-commands 
+  A-ELMC3-SSPC-commands 
+  A-ELMC4-SSPC-commands 

transfer-relay-status  -  *Raw  data  of  Transfer  relays  to  the  ELMCs* 

R-ELMC-l-relays 
+  R-ELMC-2-relays 
+  R-ELMC-3-relays 
+  R-ELMC-4-relays 

transfer-relay-commands  -  ‘Actual  commands  for  Transfer  relays* 

*PSP  — >  ELMCs  -->  Transfer  relays* 

1 { A-ELMC-ac-TR-posi t ion } 4 
+  1 (A-ELMC-dc-TR-position) 4 


R-ELMC-ac-bus-voltage  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 

R-ELMC-dc-bus-vol tage  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 

R-ELMC-batte ry-vol tage  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 

B-ELMC-cont rol-data  -  1{  B-Priority-level 

+  B-ac-TR-command 
+  B-dc-TR-command 
+  B-SSPC-power-request 
+  1 {B-SSPC-power-request }  100 

+  ( B- DP-f aul t- inhibi t ) 

)4 

B-ELMC-statu6  -  *ELMC  status  to  the  PSP  via  the  1553B  bus* 
1(  [  B-ac-TR-posi tion 
+  B-dc-TR-position 
+  B-ELMC-ac-voltage 
+  B-ELMC-dc-voltage 
+  B-ELMC-battery-voltage 
+  1 { B-ELMC-diode-status } 2 

|  l{B-SSPC-trip-bit}100 
+  1 ( B- SSPC- on/of  f-bi t } 100 

1 

M 

R-ELMC-powe r-bus-statu6  -  1 { R-ELMC-ac-bus-voltage ) 4 

+  1 { R-ELMC-dc-bus-voltage } 4 

+  1 ( R-ELMC-battery-vol tage } 4 


ELMC-CONTROL-DATA  -  *Data  from  the  1553B  data  bus--6ent  by  the  PSP* 

1{  ac-TR-command- f lag 
+  dc-TR-command- f lag 
+  priority-level-word 


Figure  4.4 ■  1 1 .  Definition(s)  in  DFD:  3 


+  1 (SSPC-power-request-bit) 100 

M 


SSPC-power-request-bit  -  ‘Local  ELMC  processor  data  flow* 

B-ac-TR-command  -  TBD 
B-dc-TR-command  -  TBD 
B-SSPC-power-request  -  TBD 
B-Priority-level  -  *16  levels;  from  PSP* 

R-ELMC-bus-diode-status  -  *TBD  in  the  detail  design  phase* 

B-DP-fault-inhibit  -  *Commmand  data  from  the  PSP* 

BOOLEAN 

manual-priority-select  -  *Manual  switch  from  the  Electricl  System* 

•Control  Pannel  for  either  ELMCs  or  RTs* 
RAW-MANUAL- PROR I TY-SELECT 

ELMC-STATUS-DATA  -  1 { SSPC- s ta tus-da t a } 1 00 

+  ELMC-Voltage-data 
+  Transfer-relay-status-data 

SSPC-status-data  -  TBD 
ELMC-Voltage-data  -  TBD 
Transfer-relay-status-data  -  TBD 

Figure  4.4-11.  Definition(s)  in  DFD:  3  (Continued) 
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Priority  level 
o  Desired  AC  Transfer  Relay  Position 

o  Desired  DC  Transfer  Relay  Position 

o  SSPC  Power  Requests 

o  DP  Fault  Inhibit 

These  control  commands  are  processed  and  stored  in  the  local  repository  file, 
ELMC-CONTROL-DATA. 

4. 4. 5. 2  Control  SSPCs 

This  process  of  the  ELMC  software  monitors  individual  SSPCs  status  and 
performs  ELMC  emergency  control.  A  set  of  SSPC  power  request  bits  are 
retrieved  from  the  ELMC-CONTROL-DATA  file.  These  power  request  bits  are 
functions  of  the  priority  level  received  from  the  PSP;  they  are  used  for 
calculation  of  the  actual  commands  for  the  SSPCs.  The  operator  may  select  a 
manual  priority  switch  which  indicates  override  condition  for  the  ELMC;  this 
process  monitors  this  manual  priority  level  and  selects  appropriate  SSPC  power 
request  bits  for  the  calculation  of  the  actual  SSPC  commands.  SSPC  status 
includes  SSPC  trip  status  and  on/off  status.  SSPC  trip  status  is  used  for 
calculation  of  the  actual  SSPC  commands,  whereas  the  on/off  status  is 
monitored  and  stored  in  the  EMC-STATUS-DATA  file. 

4. 4. 5. 3  Monitor  ELMC  Voltages 

This  process  of  the  ELMC  software  monitors  the  ELMC's  local  power  buses 
components'  status  via  local  sensors.  This  status  includes  bus  voltages  of 
AC,  DC  and  battery  power  buses  and  status  of  two  diodes  connected  to  the 
battery  bus;  this  status  is  stored  in  the  ELMC-STATUS-DATA  file. 

4. 4. 5. 4  Transmit  ELMC  Data 

This  process  of  the  ELMC  software  retrieves  the  SSPC  status,  ELMC  power  bus 
status,  and  transfer  relay  status  from  the  ELMC-STATUS-DATA  file  and  packages 
them  to  conform  to  the  protocol  of  MIL-STD-1553B  message  words.  This 
information  is  transmitted  to  the  main  PSP  synchronously;  SSPC  status  is 
transmitted  once  per  major  frame  and  the  rest  of  information  is  transmitted 
every  third  minor  cycle. 


4. 4. 5. 5  Control  Transfer  Relays 


This  process  of  the  ELMC  software  controls  the  AC  and  DC  transfer  relays 
residing  in  the  ELMC.  It  retrieves  control  data  associated  with  the  desired 
positions  from  the  ELMC-CONTROL-DATA  file,  and  retrieves  the  ELMC  bus  voltages 
data  from  ELMC -STATUS- DATA  file.  It  also  receives  the  transfer  relays'  status 
from  the  local  sensor.  Transfer  relays  commands  are  generated  by  processing 
data  listed  above,  and  the  process  goes  through  iteration  loops  to  ensure  the 
desired  relay  positions  are  in  contact. 

4.4.6  Perform  RT  Functions 

The  FTEPS's  RT  incorporates  a  MIL-STD-1750A  microcomputer.  It  has  hardware 
interfaces  with  up  to  24  EMPCs,  main  power  bus  voltage  sensors,  battery  state 
of  charge  input,  TRU  status  input,  two  diode  status  inputs  associated  with  the 
main  battery  buses,  and  the  ESCP's  manual  priority  select  switches.  In 
addition,  the  RT  has  hardware  interfaces  with  a  dual  redundant  MIL-STD-1553B 
multiplex  data  bus.  The  RT  is  considered  as  a  remote  terminal  of  the 
MIL-STD-1553B  data  bus.  For  external  power  transfer,  RT  #2  also  has  a 
hardware  interface  to  the  BTBs,  GCBs,  external  power  contactors,  and  GCUs. 

The  RT  software  resides  in  the  RT  that  is  a  part  of  the  distributed  computer 
network  designed  to  manage  and  control  the  FTEPS.  The  RT  software  provides  in 
a  laboratory  environment,  those  functions  of  the  RT  that  are  essential  for 
successful  operation  and  testing  of  the  RT  local  control.  These  functions 
include  the  following: 

o  Handle  PSP  Control  Commands 

o  Monitor  Main  Power  Buses 

o  Monitor  EMPC  status 

o  Control  EMPCs 

o  Monitor  External  Power  Operation 

o  Transmit  RT  Status  Data 

o  Perform  RT  Emergency  Functions 
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The  process,  Perform  RT  Functions,  has  software  interfaces  with  the  main  PSP 
through  data-flows,  B-RT-control-data  and  B-RT  status.  Details  of  all 
data-flows  and  subprocesses  of  the  software  is  shown  in  Figure  4.4-12,  DFD4. 

A  list  of  local  definitions  for  the  DFD4  is  shown  in  Figure  4.4-13;  this  list 
includes  a  subset  of  the  DD  directly  related  to  this  process,  and  local 
diagrams'  internal  data-flows. 

4.4.6. 1  Receive  MIL-STD-1 553B  Bus  Data 

This  process  of  the  RT  software  is  designed  to  receive  PSP  control  data 
through  data-flow,  B-RT-control-data,  via  the  MI L-STD- 1 553B  data  bus.  The 
control  data  includes  priority  level,  AC  EMPC  on/off  commands  and  DC  EMPC 
on/off  commands.  These  commands  are  processed  and  stored  in  the  local 
repository  file,  RT-CONTROL-DATA  file. 

4. 4. 6. 2  Control  EMPCs 

This  process  of  the  RT  software  monitors  individual  EMPC's  status  and  performs 
RT  emergency  control.  A  set  of  EMPC  power  request  bits  are  retrieved  from  the 
RT-CONTROL-DATA  file.  These  power  request  bits  are  functions  of  the  priority 
level  received  from  the  PSP;  they  are  used  for  calculation  of  the  actual 
commands  for  the  EMPCs.  The  operator  may  select  a  manual  priority  switch 
which  indicates  an  override  condition  for  the  RT;  this  process  monitors  the 
manual  priority  level  and  selects  the  appropriate  EMPC  power  request  bits  for 
the  calculation  of  the  actual  EMPC  commands.  EMPC  status  includes  EMPC  trip 
status  and  on/off  status.  EMPC  trip  status  is  used  for  calculation  of  the 
actual  EMPC  commands,  whereas  the  on/off  status  is  monitored  and  stored  in  the 
RT-STATUS-DATA  file. 

4. 4. 6. 3  Monitor  Main  Power  Buses 

This  process  of  the  RT  software  monitors  the  main  power  buses  components' 
status.  This  status  includes  bus  voltages  of  the  AC,  DC  and  battery  power 
buses,  state  of  charge  (SOC)  of  the  batteries,  TRU  status  and  the  status  of 
two  diodes  connected  to  the  main  battery  buses;  this  status  is  stored  in  the 
RT-STATUS-DATA  file. 
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Figure  4.4-12.  DFD4.  Perform  RT  Functions 
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EMPC-status 


-  * EMPC  raw  data  for  the  RTs* 

R-RT#l-EMPC-status 
+  R-RTI2-EMPC-Status 
+  R-RTI 3 -EMPC- Status 
+  R-RT# 4 -EMPC- Status 

EMPC-commands  -  ‘Actual  commands  from  the  RTs  to  the  EMPCs* 
1 {A-ac-EMPC-on/cf f ) 40 
+  1 ( A-dc-EMPC-on/of f } 4  0 

GCB-status  -  ‘Generator  Control  Breakers'  status  positions* 
‘Directly  wired  raw  data  of  GCBs  to  the  RTs* 
R-GCB-#l-position 
+  R-GCB-#2-position 
+  R-GCB-#3-position 
+  R-GCB-#4-position 


EPC-command-status  -  ‘External  Power  Contactors'  command  statu 

* EPCs  raw  data  — >  RT  12* 

R-EPC-1- command-status 
+  R-EPC-2-command-status 
+  R-External-power-quality 

BTB-status  -  ‘Bus  Tie  Breaker  hardwired  status  line  to  the  RTs 
*BTBs  — >  RTs* 

R-BTB- 1-pos i t i on 
+  R-BTB-2-position 
+  R-BTB-3-position 
+  R-BTB-4-posi tion 

R-main-dc-bus-voltage  «  ‘Actual  analog  voltage  level* 

‘From  the  voltage  sensor* 
ANALOG-VOLTAGE 

R-main-battery-voltage  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 

R-EPC-l-command-status  -  ‘Hardwired  status  bit  to  RT  #2* 

R-EPC-2-com*and-status  -  ‘Hardwired  status  bit  to  RT  #2* 

B-RT-control-data  -  *RT  control  data  PSP  — >  RT  via  the  1553B* 

1{  B-Priority-level 
+  1 { B-ac-EMPC-on/of f-command ) 1 2 

+  1 ( B-dc-EMPC-on/of f-command } 18 

M 

‘For  RT  II  &  14,  ac-EMPC-commands : -10* 

*  dc-EMPC-commands : -18* 
‘For  RT  12  &  13,  ac-EMPC-commands : -12* 

*  dc-EMPC-commands : -17* 

B-RT-status  -  *RT  status;  RT--PSP  via  the  1553B  bus* 
B-RTIl-status 
+  B-RTf 2-status 
+  B-RTI 3-status 
+  B-RT|4-status 

R-main-power-bus-status  -  1 { R-ma i n-ac-bus-vol tage } 4 

+  1 { R-main-dc-bus-voltage } 4 

+  1 { R-main-battery-voltage } 2 

+  1 (R-main-battery-SOC) 2 

Figure  4.4-13.  Definition(s)  in  DFD:  4 


+  1 jR-main-bu6-TRU-statu6 )  4 


B-Priority-level  -  *16  levels;  from  PSP* 


RT-CONTROL-DATA  -  1 { EMPC-powe r-request-bi t } 50 


EMPC-power-request-bi t  -  ‘Binary  bit;  may  be  from  a  matrix* 

BOOLEAN 


RT-STATUS-DATA  -  EMPC-Status-data 
+  Main-Voltage-data 
♦  EPC-status-data 


R-main-bus-diode-status  -  *TBD  in  the  detail  design  phase* 


B-ac-EMPC-on/of f-command  -  *AC  EMPC's  power  request  bit* 

‘from  the  PSP* 

BOOLEAN 


B-dc-EMPC-on/of f-coamand  -  *DC  EMPC's  power  request  bit* 

♦from  the  PSP* 

BOOLEAN 


R-main-ac-bus-voltage  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 


manual-priority-select  -  ‘Manual  switch  from  the  Electricl  System* 

‘Control  Pannel  for  either  ELMCs  or  RTs* 
RAW- MANUAL- PROR I TY- SELECT 


External-power-ready  -  ‘Discrete  hardwired  to  the  GCU* 

BOOLEAN 


EMPC-status-data  -  1 { EMPC-tr ip-status) 50 

+  1 { EMPC-on/of f-status} 50 


Main-Voltage-data  -  ‘Internal  to  the  ELMC  software* 

1 (main-a c-bus- voltage ) 4 
+  1 {main-dc-bus-voltage ) 4 

♦  1 {main-battery-voltage } 2 

+  1 (main-battery-SOC) 2 

+  1 {main-bus-TRU-status ) 4 

+  1 {main-bus-diode-status ) 4 


EPC-status-data  -  ‘Internal  to  the  RT  software* 

EPC-l-on/of f 
♦  EPC-2-on/off 


R-External-power-quality  -  TBD 


R-main-battery-SOC  -  ‘Percentage  of  battery  charge* 

REAL 


R-main-bus-TRU-status  -  ‘Actual  analog  voltage  level* 

ANALOG-VOLTAGE 


Figure  4.4-13.  Definition (s)  in  DFD:  4  (Continued) 


4. 4. 6. 4  Transmit  RT  Status 


This  process  of  the  RT  software  retrieves  the  EMPC  status,  main  power  bus 
status,  TRU  status,  or  EPC  position  from  the  RT-STATUS-DATA  file,  and  packages 
them  to  conform  to  the  protocol  of  MIL-STD-1 553B  message  words.  This 
information  is  transmitted  to  the  main  PSP  synchronously;  EMPC  status  is 
transmitted  once  per  major  frame  and  the  rest  of  the  information  is 
transmitted  every  third  minor  cycle. 

4. 4. 6. 5  Monitor  E PCs 

This  process  of  the  RT  software  monitors  the  external  power  system  by 
processing  the  two  EPC s ‘  command  status,  four  BTBs '  status,  and  four  GCBs ' 
status;  it  generates  the  external  power  ready  signal  for  the  control  of  the 
external  power  contactors.  The  external  power  ready  signal  is  hardwired  to 
the  GCU. 

4.4.7  Structured  Methodology  Examples 

Preliminary  Structured  Analysis  was  performed  during  Phase  II  of  the  FTEPS 
program.  The  preliminary  SA  includes  three  levels  of  DFDs  and  a  preliminary 
DD.  Sections  4.4.2  through  4.4.6  described  the  DFDs  identified.  Most  DD 
definitions  are  formulas  that  declare  the  item  being  defined  to  be  made  up  of 
some  related  set  of  components.  It  is  desirable  to  choose  a  small  set  of 
simple  operators,  and  then  allow  the..i  to  be  used  in  combination  to  construct 
complex  operators.  A  compact  set  of  relational  operators,  in  forms  of  their 
symbolic  notations  that  can  be  used  to  construct  any  definition  in  our  DD 
fol lows : 

=  means  IS  EQUIVALENT  TO. 

+  means  AND. 

[]  means  EITHER-OR;  i.e.,  select  one  of  the  options  enclosed  in  brackets. 
{}  means  ITERATIONS  OF  the  component  enclosed. 

()  means  that  the  enclosed  component  is  OPTIONAL. 

**  means  that  the  enclosed  texts  are  comments. 


VW 


TT 


y  f  y  ■  VR  y  ve 1  1  !FTIF  ir^FTM"VHV^g"g*W 


M 


*VW* 


!  V'T 


An  example  of  DD  entries  are  listed  in  Figure  4.4-14.  With  these  relational 
operators,  the  data-flow  B-RT-status  is  clearly  visualized.  It  includes  four 
pieces  of  data,  B-RT#l-status,  B-RT#2-status,  B-RT#3-status  and 
B-RT#4-status .  Furthermore  the  details  of  the  component  B-RT # 1 -status  shows 
that  two  sets  of  data  may  be  transmitted  to  the  PSP  via  the  MI L-STD-1 553B  bus 
from  the  RT.  These  two  sets  of  data  include  information  of  the  EMPCs  and 
information  of  the  power  bus  status.  This  example  does  not  indicate 
conditions  for  use  of  the  data;  this  shall  be  incorporated  in  the  DD  of  the 
Structured  English  during  the  detail  design  phase. 

Structured  English  states  the  functional  control  and  policy  of  the  system. 
Structured  English  for  each  of  the  primitive  processes  of  the  FTEPS  shall  be 
defined  during  the  detail  design  phase.  An  example  of  the  Structured  English 
is  shown  in  Figure  4.4-15;  a  complete  specification  of  the  Structured  English 
may  include  the  policy  of  error  handling,  self-checking,  and  control 
processing  of  the  system.  This  example  shows  the  control  processing  portion 
of  the  process  Control  SSPCs.  The  control  scheme  for  each  of  the  SSPCs  is 
identical  for  all  four  ELMCs,  thus  the  number  of  SSPCs  to  be  controlled  is  not 
specified.  This  information  shall  be  made  available  in  either  the  DD,  the 
Decision  Table,  or  the  Decision  Tree. 

Upon  completion  of  the  Structured  Analysis,  Structured  Design  shall  begin. 

Its  main  documentation  tools  include  the  structured  charts  and  pseudo  codes. 
Examples  of  the  structured  chart  and  pseudo  codes  are  shown  in  Figures  4.4-16 
and  4.4-17.  These  examples  include  only  a  portion  of  the  process  Control 
SSPCs;  it  shows  the  control  coupling  and  cohesion  of  the  module  Command  SSPCs 
with  its  submodules  as  shown,  and  its  higher  level  control  module  (actual 
module  is  not  shown  in  the  figure,  but  the  data  paths  are  identified).  This 
module  is  concerned  with  the  desired  SSPC  power  requests  only;  it  does  not 
check  for  the  overriding  condition  from  the  ESCP  as  described  in  the 
Structured  English.  It  acquires  all  necessary  data  to  calculate  the  actual 
command  for  the  SSPC  according  to  the  equation  provided  in  the  pseudo  code. 

The  submodules  are  classified  as  the  input  module,  process  module,  output 
module,  control  module,  and  etc.  The  structured  chart  defines  data  structure 
of  the  actual  software;  global  and  local  identifiers  are  separated  and  definpd 
under  different  levels  of  hierarchy,  thus  configuration  control  is  easily 
managed . 
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B-  RT-  status  =  *RT  status;  RT==>  PSP  via  the  1553B  bus* 

B-RT  #1 -status 
+  B-RT  #2— status 

+  B-  RT  #3- status. 

+  B-RT  #4 -status 

B-RT  #1— status  =  (  1  I  B— ac-  EMPC-on/off-  status  110 

+  1  IB-ac-EMPC- trip- status  110 

+  1  |  B-dc-  EMPC -on/off-status  1 18 

+  1  IB- dc- EMPC -trip- status  118 

I  B— ac-bus  #1- voltage 
+  B-dc— bus  #1— voltage 
+  B-TRU-#1-status 

1 

Figure  4.4-14.  Data  Dictionary  Example 
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DETAILS 


PROCESS  3.2  CONTROL  SSPCs 
•Command  individual  SSPCs* 

FOR  EACH  SSPC 

I F  manual  priority  select  is  chosen 
THEN 

get  manual  request  bit 

ELSE 

get  SSPC  power  request  bit 
ENDIF 

acquire  the  SSPC  trip  status 
calculate  the  SSPC  control  command 
command  the  SSPC 
update  the  ELMC-STATUS-DATA  file 

Figure  4.4- 15.  Structural  English  Example 
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Generate 

Get  priority 

SSPC 

bit 

Control 

Command 

Send  SSPC 

Control 

Command 


Figure  4.4-16.  Structure  Chart  Example 


COMMAND  SSPCs 


Receive  SSPC  power  requests 
Receive  priority  level 
Receive  manual  requests 
Repeat 

Get  SSPC  trip  bit 
Get  priority  bit 

Generate  SSPC  control  command  ; 

Send  SSPC  command 
Until  all  SSPC  commands  sent 

Figure  4.4- 17.  Psuedo  Code 


SSPC  control  equation 
C=lPZ  +  M 

L  =  trip 

£  =  priority  bit 
P  =  priority  level 
Z  =  power  request 
M  =  manual  request 
C  =  control  command 
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In  summary,  the  goal  of  using  this  structured  methodology  is  to  reduce 
software  life  cycle  cost,  ensure  the  production  of  quality  software,  and 
provide  configuration  management. 

4.5  FTEPS  Demonstrator  Hardware 

The  FTEPS  demonstrator  preliminary  design  effort  has  focussed  on  developing  a 
laboratory  demonstrator  that  offers  the  user  a  means  to  test  and  monitor  FTEPS 
with  the  intent  of  eventually  specifying  an  electrical  system  which  meets  the 
requirements  of  an  ATF  type  aircraft. 

Tii e  FTEPS  demonstrator  hardware  and  components  described  in  the  following 
paragraphs  include  a  control  console,  an  integrated  load  simulator  and  an 
equipment  rack  with  a  power  shield.  Figure  4.5  shows  one  possible  ensemble  of 
these  components  and  their  relationship  to  one  another. 

4.5.1  Control  Console 

The  FTEPS  demonstrator  control  console  provides  overall  demonstrator  system 
control  through  inputs  by  the  system  operator  and  the  automated  features 
programmed  into  the  system  computer.  Control  console  functions  are  shown  in 
Figure  4. 5. 1-1.  The  electrical  system  generation  and  distribution  network  is 
monitored  and  data  displayed  on  the  controls  and  display  panel  and  on  the 
graphics  terminal  located  at  the  console.  In  addition,  pre-specif ied  system 
commands  can  be  introduced  by  the  system  operator  through  the  avionics 
simulator  terminal  also  located  at  the  control  console.  The  operator  can  also 
make  limited  software  modifications  through  the  avionics  simulator  terminal 
which  impact  the  automated  features  of  FTEPS. 

The  control  console  will  also  provide  information  on  the  generator  drive 
system.  This  is  to  ensure  the  appropriate  coordination  between  the  FTEPS 
control  console  and  the  drive  stands  control  console  should  the  consoles  be 
located  remotely  from  one  another. 


tXMAUSl 


VISUAL  SYSTEM  MONITORING 
FOR  SYSTEM  OPERATION/ 
FAULT  RESPONSE 

•  ELECTRICAL  SYSTEM 

ARCHITECTURE 

•  CONTROL  SYSTEM 

ARCHITECTURE 

•  LOAD  SIMULATOR 

LOAD  STATUS 


AIRCRAFT  INTERACTION 

•  GENERATOR  ON/OFF 

•  EMERGENCY  OVERRIDE 

•  COCKRIT  TYRE  DISPLAYS 


SYSTEM  INDICATORS/ 

MONITORS 

•  DATA  BUS  MONITOR 

(LORAL -SBA 100) 

•  SYSTEM  INDICATORS 

(VOLTAGE/CURRENT  AC  AND  DC) 

•  OPERATIONAL  SYSTEM  CONFIGURATION 

AND  FAULT  STATUS 


Figure  4.5. 1-1.  Control  Console  Functional  Diagram 
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The  FTEPS  control  console  is  divided  into  three  major  sections  (shown  in 
Figure  4. 5. 1-2).  These  are  the  demonstrator  instrumentation  controls  and 
displays,  the  simulated  aircraft  cockpit  electrical  systems  controls  and 
displays  panel,  and  the  demonstrator  electrical  system  flow  display. 

Aircraft  EPS  Control  Panel 

The  aircraft  EPS  control  panel  is  designed,  to  simulate  aircraft  pilot  control 
over  the  electrical  power  system.  This  control  panel,  shown  in  Figure  4.5. 1-3 
is  located  near  the  center  of  the  control  console.  Primary  functions  are  to 
provide  ON/OFF  capability  for  the  generators  and  batteries  (system  power- 
sources).  In  addition,  automatic  control  of  the  system  may  be  overridden 
through  the  Load  Management  Emergency  switch.  This  switch  provides  a  hardwire 
link  between  the  control  console  and  the  ELMCs  to  force  a  predefined  SSPC 
ON/OFF  configuration  as  specified  by  the  switch  position.  When  engaged  the 
load  management  emergency  switch  signal  will  have  priority  over  all  other  ELMC 
control  inputs.  All  other  cockpit  type  displays  of  data  will  be  throuqh  the 
graphics  terminal  located  on  the  console  table. 

Monitor  display  information  must  be  requested  through  the  terminal  keyboard. 
The  system  is  designed  to  allow  display,  on  request,  of  the  following 
information  types:  preflight  system  self-check,  post  flight  maintenance  data, 
or  in-flight  system  status.  All  information  types  will  be  displayed  in  a 
predefined  format.  An  example  of  the  display  modes  available  to  the  system 
user  are  shown  in  Figures  4. 5. 1-4  and  -5.  These  show  in-flight  system  status 
which  is  presented  in  a  two  screen  format. 

EPS  F  low  Display 

The  FTEPS  electrical  power  system  flow  display  panel  provides  a  quick  look  at 
the  overall  system  status.  System  elements  to  be  included  on  this  panel  are 
shown  in  Figure  4.5. 1-6.  The  display  will  highlight  system  power  flow  by 
indicating  contactors  "on"  with  a  lamp  as  well  as  other  individual  components 
such  as  generators,  converters,  AC  and  DC  buses  and  batteries.  An  additional 
display  panel  (not  shown)  will  indicate  the  on/off  status  of  the  individual 
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Figure  4.5. 1-2.  Demonstrator  Control  Console 
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LOAD  MANAGEMENT  EMERGENCY  MODE 


□  □  □ 

TAKE  CRUISE  LANDING  OF  E 

OFF 


Figure  4.5. 1-3.  Generator  Control  Panel 
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SYSTEM  STATUS 


MODE 

GENl  GEN2 

100  AMPS  100  AMPS 

PARALLEL 

CAPACITY 

TRU1  TRU2  BA7T1  BATT2 


MODE 

GEN3  GEN4 

110  AMPS  110  AMPS 

PARALLEL 

TRU3  TRU4 


28.1  Volts  27.5  Volts  907,  857  27.6  Volts  27.1  Volts 

ELMC1  ELMC2  ELMC3  ELMC4 

AC  DC  BATT  AC  DC  BATT  AC  DC  BATT  AC  DC  BATT 

1  D  I  2  B  2  4  A  1  3  C  2 

113  23  7  H3  26  6  ]  14  26  7  114  25  6 


Figure  4. 5. 1  -4.  Normal  Display  Mode  (Screen  1 ) 


SYSTEM  STATUS 


LOAD  MANAGEMENT  PRIORITY  LEVEL  :  I 


FLIGHT  MODE 

:  CRUISE 

*  *  FAULTS  * 

* 

GENERATOR 

:  NO  FAULT 

ELMCI  : 

NO  FAULT 

MAIN  BUS 

:  NO  FAULT 

SSPC  STATUS  : 

NO  FAULT 

TRU 

:  NO  FAULT 

ELMC2  : 

NO  FAULT 

DC  BUS 

:  NO  FAULT 

SSPC  STATUS  : 

NO  FAULT 

BATT 

:  NO  FAULT 

ELMC3  : 

NO  FAULT 

BATT  BUS 

:  NO  FAULT 

SSPC  STATUS  : 

NO  FAULT 

ELMC4  : 

NO  FAULT 

SSPC  STATUS  : 

NO  FAULT 

Figure  4.5. 1-5.  Normal  Display  Mode  (Screen  2) 


LENGEND 

O  LIGHT  ON  INDICATES  CONTACTOR/EMRC  ON* 
•  LIGHT  ON  INDICATES  ELEMENT  ON 


Figure  4.5. 16.  Electrical  Power  System  Flow  Display 
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loads  simulated  by  the  integrated  load  simulator.  This  will  provide  the  user 
with  an  indication  of  the  load  switching  during  the  transition  from  one  load 
management  mode  to  another. 

Instrumentation  Controls  and  Display  Panel 

The  instrumentation  panel  provides  the  user  with  an  additional  means  of 
monitoring  FTEPS.  The  panel  will  be  designed  for  both  hardwire  and  data  bus 
monitoring.  The  data  bus  link  will  be  made  through  a  LORAL  SBA-100  data  bus 
monitor.  The  hardwire  interface  and  the  specific  types  of  monitoring 
equipment  required  will  be  determined  during  detailed  design. 

4.5.2  Integrated  Load  Simulator 

The  integrated  load  simulator  simulates  the  individual  loads  of  the  ATF  type 
aircraft  developed  in  Phase  I.  The  load  simulator,  shown  functionally  in 
Figure  4. 5. 2-1,  is  designed  to  operate  independent  of  the  demonstrator 
console.  Power  required  for  operation  is  provided  through  its  own  receptacle 
and  is  typical  laboratory  power  (480  V  three-phase,  60  Hz).  Cooling  fans  for 
the  loads  are  provided  within  the  simulator  unit  and  are  designed  to  maintain 
a  maximum  heat  transfer  of  30,000  BTU/Hr.  into  the  laboratory.  This  can  be 
achieved  with  the  benefit  of  outside  cooling  air  available  to  the  laboratory. 
These  features  are  shown  in  the  load  simulator  functional  diagram.  Figure 

4. 5. 2- 1 . 

A  preliminary  design  of  the  load  simulator  structure  is  shown  in  Figure 

4. 5. 2- 2.  External  features  include  connections  to  the  inlet  and  outlet  air 
plenums  and  load  selection  panels  to  select  the  appropriate  load  type  to  be 
simulated.  Figure  4. 5. 2-3  is  an  example  of  the  flight  critical  loads 
selection  panel.  Similar  panels  for  mission  critical  loads  and  non-flight 
critical  loads  are  also  located  on  the  load  simulator  unit.  The  load 
simulator  provides,  at  a  minimum,  loading  capability  for  71  three-phase  ac 
loads,  31  single-phase  ac  loads  and  47  dc  loads.  The  loads  which  represent 
the  flight  critical  and  mission  critical  functions  have  multiple  inputs  for 
redundancy,  generally  three  inputs  (2  ac  and  1  dc)  for  the  flight  critical 
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Figure  4.5  1.  Load  Simulator  Functional  Diagram 
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Figure  4. 5.2-2.  Integrated  Load  Simulator,  Preliminary  Design 
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Figure  4.5.2 -3.  Load  Bank  Load  Selection  Panel  ( Typical ) 
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loads  and  two  inputs  (2  ac  or  2  dc)  for  the  mission  critical  loads.  This 
loading  scheme  is  shown  in  Figure  4. 5. 2-4  along  with  the  power  distribution 
scheme  for  the  ELMCs.  Typical  loads  are  shown  in  the  figure  with  ac  power 
distributed  from  buses  1  through  4  and  dc  power  distributed  from  buses  A 
through  0.  In  addition  the  power  source  designated  by  the  lower  case  "a"  or 
"b"  is  from  the  uninterruptible  battery  powered  bus  (see  section  4.1). 

The  load  simulator  will  be  designed  to  handle  the  uninterruptible  load 
requirement  similar  to  that  of  a  power  supply  as  shown  in  Figure  4. 5. 2-5.  The 
dc  to  dc  converter  will  not  be  required  since,  for  simulation  purposes,  the  28 
Vdc  input  will  simplify  the  design  as  is.  The  loads  within  the  simulator 
represent  the  steady-state  operating  characteristics  of  the  loads  defined  in 
Phase  I.  These  loads  are  typical  of  those  anticipated  for  an  ATF  type 
aircraft.  A  function  of  the  load  simulator  is  to  allow  for  system  simulation 
of  a  load  profile  (as  shown  in  Figure  2.1-2)  of  that  ATF  type  aircraft. 

4.5.3  Demonstrator  Equipment  Rack 

The  demonstrator  equipment  rack  will  house  the  major  hardware  components  of 
FTEPS .  It  is  the  primary  point  of  electrical  power  distribution  and  control 
as  shown  in  Figure  4. 5. 3-1.  There  are  two  major  sections  to  the  equipment 
rack.  These  are  the  racks  which  hold  the  electrical  control  and  distribution 
equipment  and  the  power  shield  which  houses  the  main  buses  and  power  switching 
and  protection  components. 

ihe  tnuipment  mounted  on  the  rack  (shown  in  Figure  4. 5. 3-2)  will  include  four 
electrical  load  management  centers  (ELMC),  two  power  system  processors  (PSP), 
jur  remote  terminals  (RT),  four  generator  control  units  ( GCU ) ,  four 
transformer  rectifier  units  (TRU)  and  two  batteries.  The  equipment  will 
provide  for  their  own  cooling  where  required.  Additional  space  will  oe 
allocated  within  the  rack  to  provide  mounting  for  other  equipment  which  may  be 
deemed  appropriate  for  incorporation  into  the  demonstrator  as  either  a  1 oa  "  or 
possibly  some  other  control  device. 

Another  function  of  the  equipment  rack  is  to  house  all  equipment  and  component 
associated  with  the  system  power  shield.  These  will  be  located  in  the  rear 
closed  section  of  the  equipment  rack.  All  power  distribution  buses  and  powe>- 
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Figure  4.5. 2-5.  Uninterruptible  Load  Configuration 
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Figure  4. 5. 3-1.  Equipment  Rack  Functional  Diagram 


flow  control  devices  associated  with  the  generators  are  included  in  the  power 
shield.  These  are  the  bus  tie  breakers,  the  generator  circuit  breakers,  the 
external  power  contactors,  the  battery  contactors  and  current  transformers. 
Also  included  in  the  power  shield  will  be  the  electromechanical  power 
controllers  (EMPC)  which  control  power  distribution  to  the  larqe  system  loads 
and  ELMCs. 

The  equipment  rack  through  either  the  power  shield  or  its  control  equipment 
interfaces  with  the  other  major  components  of  the  FTEPS  demonstrator:  the 
control  console,  the  integrated  load  simulator  and  the  qeneration  system.  The 
Westinghouse  VSCF  generators  and  converters  located  in  the  drive  stand  room 
interface  to  the  equipment  rack  via  power  feeders  which  connect  to  the  main 
system  buses  through  the  GCBs  as  shown  in  Figure  4. 5. 3-3.  Monitor,  control 
and  protective  functions  of  the  generation  system  are  performed  by  the  GCUs 
and  interface  through  control  wires  and  a  M1L-STD-1553B  data  bus  link.  This 
interface  will  be  made  between  the  equipment  rack,  power  shield  and  the 
generator/converters . 

A  primary  function  of  the  equipment  rack  power  shield  will  be  to  distribute 
power  from  the  main  buses  to  the  ELMCs  and  then  to  the  simulated  loads  which 
reside  within  the  Integrated  Load  Simulator.  Since  a  large  number  of  loads 
are  being  contemplated  for  the  FTEPS  simulations,  the  complexity  of  the  wiring 
harness  and  the  routing  requirements  of  these  wire  bundles  will  be  addressed 
early  in  detailed  design. 

The  loading  of  the  buses  will  also  include  the  capability  of  bulk  loading 
through  additional  EMPCs  to  load  banks.  The  objective  for  this  is  to  fully 
load  the  FTEpS  generators  to  maximize  the  impact  of  load  management.  Cables 
to  the  load  banks  will  be  via  the  interface  panels  located  in  the  drive  stand 
room. 

The  control  console  monitors  FTEPS  through  data  bus  and  control  signal  wiring 
connected  to  the  equipment  and  monitoring  devices  primarily  located  within  the 
equipment  rack.  The  interface  will  include  FTEPS  and  demonstrator  cabling. 

The  demonstrator  cabling  will  include  all  display  signals  for  instrumentation 
necessary  to  ensure  optimum  user  monitoring  capability  of  FTEPS. 
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5.0 


CONCLUSIONS  AND  RECOMMENDATIONS 


5.1  Conclusions 

The  preliminary  design  of  the  FTEPS  demonstrator  has  been  completed.  Based  on 
the  fault  requirements  of  the  program,  the  system  consists  of  four  primary 
generators.  The  generators  are  paralleled  in  sets  of  two,  resulting  in  two 
parallel  configurations.  To  control  the  system,  a  MIL-STD-1553B  data  bus 
network  is  used.  In  addition,  MIL-STD-1 750A  computers  are  used  in  a 
distributed  processor  network.  The  distribution  system  incorporates  solid 
state  power  controllers  for  load  control  and  fault  protection.  The  system 
design  includes  provisions  for  providing  uninterruptible  power  to  flight 
critical  loads. 

The  functional  and  operational  requirements  of  the  system  and  the  components 
have  been  defined.  These  have  been  used  to  develop  the  software  preliminary 
design  for  the  four  computer  elements  of  the  system;  the  power  system 
processor,  electrical  load  management  center,  remote  terminal,  and  avionics 
simulator.  To  complete  the  software  preliminary  design,  the  Structured 
Analysis  methodology  was  used.  The  Structured  Design  methodology  will  be  used 
in  the  detailed  design  phase.  The  software  will  be  coded  in  the  Ada  higher 
order  language. 

The  preliminary  design  includes  laboratory  support  hardware  necessary  to 
operate,  control,  and  install  the  FTEPS  Demonstrator  in  the  Aeropropul sion 
Laboratory  at  Wright-Patterson  Air  Force  Base.  The  support  hardware  includes 
the  control  console,  equipment  rack,  and  load  simulator  hardware. 

The  preliminary  design  effort  has  resulted  in  an  optimized  system  which  meets 
the  stringent  requirements  of  the  FTEPS  program  and  the  requirements  of  an  ATF 
type  of  aircraft. 

5.2  Recommendations 

The  preliminary  design  of  the  FTEPS  demonstrator  has  shown  a  complete  system 
description  of  a  fault  tolerant  electrical  power  system  and  a  means  to 


demonstrate  it.  It  is  recommended  that  the  detailed  design  of  the  system  be 
accomplished  (Phase  III)  as  specified  in  the  detailed  design  plan  and  that  the 
system  be  built  and  tested  as  described  in  Phase  IV  and  Phase  V  of  the 
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1  contract. 
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